chore: resolve open dependabot security alerts

[jonathannorris]

Summary

• Bumped org.jetbrains.kotlin:kotlin-gradle-plugin from 2.1.20 to 2.4.20-RC2 to resolve a medium-severity unsafe deserialization vulnerability in the Kotlin build cache (alert DVC-3434 when events are aggregated increment the value for the same target #57).

Notes

• No stable release fixes this yet; the first patched version listed by the advisory is a pre-release (2.4.20-Beta1). 2.4.20-RC2 is the newest available pre-release at time of writing and was verified to build and test cleanly.
• Verified with ./gradlew clean build and ./gradlew testDebugUnitTest locally (all green; one unrelated pre-existing test-order flake in testMinifiedUnitTest reproduces on both the old and new plugin version and passes on rerun).

Dependabot Alerts Resolved

Alert	Package	Severity	Fix
#57	org.jetbrains.kotlin:kotlin-gradle-plugin	medium	Bumped to 2.4.20-RC2

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[jonathannorris]

Closing: the only available patched versions of org.jetbrains.kotlin:kotlin-gradle-plugin for this alert (2.4.20-Beta1/Beta2/RC/RC2) are all rejected by this repo's CodeQL Kotlin extractor ("Kotlin version 2.4.20-RC2 is too recent. CodeQL currently supports versions below 2.4.20"), and no stable 2.4.20 release exists yet. Reverting the bump leaves this branch with a 0/0 diff, so closing rather than merging a no-op. Alert #57 (medium) is unresolvable until either a stable Kotlin 2.4.20+ ships or CodeQL adds support for it.