…ect)

Closes Dependabot #146. A *real* toolchain upgrade, not the isolated
kotlin-reflect bump Dependabot proposed (which would have mismatched the
2.3.21 compiler).

What it took (documented for next time): bumping the kotlin("jvm") plugin
to 2.4.0 alone leaves the actual compiler at 2.3.21 — Kotlin's Build Tools
API decouples the plugin version from the compiler version, and this
project's lockfiles pinned `kotlin-* {strictly 2.3.21}`. Neither
--write-locks nor --update-locks could override the strict lock in one
pass (the existing strict version wins the conflict, then re-persists).
The fix: drop the kotlin 2.3.21 lock lines from every lockfile, then
--write-locks, so they re-resolve to the 2.4.0 plugin default.

Result (verified via dependencyInsight): kotlin-compiler-embeddable,
kotlin-stdlib, and kotlin-reflect all 2.4.0 on the compile/runtime
classpaths. The 2.4.0 compiler compiles the codebase with no new errors
(only the pre-existing ForumBuilder unchecked-cast warnings). Full
./gradlew build green, all tests pass, detekt baseline steady at 415.

- build.gradle.kts: plugin + both kotlin-reflect -> 2.4.0
- Regenerated all gradle.lockfiles (kotlin-only churn; no other dep moved)
  + added 2.4.0 sha256 checksums to verification-metadata.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>