Scope and resolve PMD findings in grails-forge

## Summary

The independent `grails-forge` build currently produces 224 PMD findings across five source-bearing modules after generated files below `build/` are excluded. Forge intentionally does not expose `aggregateAnalysisViolations`, so its baseline must be reproduced through the supported per-project PMD tasks and enforcement must use an explicit Forge CI task set or an agreed Forge-specific aggregation surface.

## Reproduction

From `grails-forge/`:

```shell
./gradlew \
:grails-forge-analytics-postgres:pmdMain \
:grails-forge-api:pmdMain \
:grails-forge-cli:pmdMain \
:grails-forge-core:pmdMain \
:grails-forge-web-netty:pmdMain \
-Pgrails.code-analysis.enabled.pmd=true \
-Pgrails.code-analysis.ignoreFailures=true
```

The XML reports are written under `build/reports/code-analysis/pmd/`.

## Baseline

| Project | Findings |
|---------|---------:|
| `grails-forge-core` | 129 |
| `grails-forge-api` | 50 |
| `grails-forge-cli` | 41 |
| `grails-forge-analytics-postgres` | 3 |
| `grails-forge-web-netty` | 1 |
| **Total** | **224** |

## Suggested approach

1. Clean modules in reviewable rule/category batches, beginning with the one- and three-finding modules.
2. Remove `grails.code-analysis.ignoreFailures=true` for each clean task as it becomes blocking.
3. Add the explicit source-bearing PMD task set to Forge CI, or introduce a separately reviewed Forge aggregation surface without reversing the intentional removal recorded in `f8d475c828`.

## Acceptance criteria

- Maintained sources in all five modules have zero findings.
- Generated sources remain absent from PMD reports.
- The five supported per-project PMD tasks run without `grails.code-analysis.ignoreFailures=true` in Forge CI.
- The complete `grails-forge` test suite passes.

From grails-forge/, run the five listed per-project pmdMain tasks with PMD enabled and inspect the XML reports under build/reports/code-analysis/pmd/. Work through findings by module, starting with grails-forge-web-netty and grails-forge-analytics-postgres, then verify generated sources remain excluded. Finish by running the complete grails-forge test suite and the Forge CI PMD task set without ignoreFailures.

Written by the indexing model from the issue text.