Stabilize SpotBugs task wiring and detector execution

## Summary

SpotBugs cannot currently be enabled reliably across the root build. A broad analysis run exposes two independent infrastructure failures before existing findings can be made blocking:

1. Gradle 9 task validation reports implicit task dependencies where SpotBugs consumes generated outputs, including `compileGsonViews`, without a declared dependency.
2. SpotBugs detector execution throws `IndexOutOfBoundsException` while analyzing some Grails-generated/controller bytecode.

These are execution/tooling failures, separate from the reported bug backlog.

## Reproduction

```shell
./gradlew aggregateAnalysisViolations --continue \
-Pgrails.code-analysis.enabled.spotbugs=true \
-Pgrails.code-analysis.ignoreFailures=true
```

## Observed behavior

- Gradle fails task validation for undeclared producer/consumer relationships involving generated Gson views.
- SpotBugs logs detector `IndexOutOfBoundsException` failures for generated/controller classes.
- The aggregate build does not complete reliably, even though many module XML reports are written.

## Suggested approach

- Model generated bytecode/source directories with explicit task dependencies or exclude outputs that SpotBugs must not analyze.
- Capture the detector name and smallest failing class from a single-module run.
- Verify whether the failure is fixed by a SpotBugs/plugin update; otherwise add the narrowest detector or generated-class exclusion with an upstream issue reference.
- Keep SpotBugs disabled in blocking CI until the broad run exits successfully.

## Acceptance criteria

- The reproduction command exits successfully without Gradle task-validation errors.
- No detector crashes or analysis exceptions appear in the logs.
- Every source-bearing module either emits a valid XML report or is explicitly and justifiably excluded.
- Any detector exclusion links to an upstream issue and a minimal reproducer.

Start with the aggregateAnalysisViolations reproduction command and inspect the compileGsonViews task relationship reported by Gradle validation. Then run analysis for a single module to identify the detector and smallest failing generated/controller class. Done means the broad run completes without validation errors or detector crashes, and each source-bearing module produces a valid XML report or has a justified exclusion.

Written by the indexing model from the issue text.