fix: enforce gRPC HTTP/2 stream limits

[lxcmyf]

Summary

• align the Netty runtime to 4.1.135.Final to consume the upstream fixes for CVE-2026-47244 and CVE-2026-50560
• enforce maxConcurrentCallsPerConnection on Netty's remote HTTP/2 endpoint before grpc-java installs its handler
• replace the unbounded default with a finite limit of 100 and document the new 0 fallback behavior
• add regression coverage that verifies an excess concurrent stream is rejected with REFUSED_STREAM

Root cause

grpc-java 1.81.0 creates DefaultHttp2Connection directly instead of using Netty's Http2ConnectionHandlerBuilder. It advertises SETTINGS_MAX_CONCURRENT_STREAMS, but does not apply the same value to connection.remote().maxActiveStreams(). As a result, the Netty builder-side fix for CVE-2026-47244 is bypassed.

java-tron now wraps grpc-java's plaintext protocol negotiator and configures the connection before the gRPC handler enters the channel pipeline. The original negotiator still handles the rest of protocol setup.

Impact

• the default maximum is now 100 concurrent calls per incoming connection
• explicitly configuring 0 also selects the secure default of 100
• operators can still configure a different positive finite limit

Validation

• ./gradlew :common:test --tests org.tron.core.config.args.NodeConfigTest :framework:test --tests org.tron.common.application.GrpcNettyMaxConcurrentStreamsLimiterTest --tests org.tron.core.config.args.ArgsTest
• ./gradlew :framework:checkstyleMain
• ./gradlew :framework:dependencyInsight --dependency netty-codec-http2 --configuration runtimeClasspath

Resolved runtime dependencies:

• io.grpc:grpc-netty:1.81.0
• io.netty:netty-codec-http2:4.1.135.Final