K2GO-358 fix(deps): raise transitive dep versions

Constrain bcprov-jdk15to18 to 1.85 and okio to 1.17.6 (transitive via
libadb-android), and bump commons-io to 2.14.0. Clears Snyk CVEs.
Version-only bumps with no direct API use, so app behavior is unchanged.

Author: luisguzman-adfa

controller/app/build.gradle

@@ -237,6 +237,17 @@ android {
 }
 
 dependencies {
+    // Security (Snyk): raise vulnerable transitive versions. The app does not call these
+    // APIs directly, so this changes only the resolved version, not app behavior.
+    constraints {
+        implementation('org.bouncycastle:bcprov-jdk15to18:1.85') {
+            because 'Snyk CVE fixes; pulled transitively by libadb-android 3.1.1 (was 1.81).'
+        }
+        implementation('com.squareup.okio:okio:1.17.6') {
+            because 'Snyk CVE fix; transitive (was 1.17.5).'
+        }
+    }
+
     // ADFA-4533: GlitchTip (Sentry-compatible) crash reporting SDK.
     implementation 'io.sentry:sentry-android-core:8.29.0'
 

controller/termux-core/build.gradle

@@ -119,7 +119,7 @@ dependencies {
 
     // --- TERMUX PATCHES ---
     implementation 'com.google.guava:guava:31.1-jre'
-    implementation 'commons-io:commons-io:2.11.0'
+    implementation 'commons-io:commons-io:2.14.0'   // Snyk CVE fix (was 2.11.0)
 
     // Markdown
     implementation 'io.noties.markwon:core:4.6.2'