Enable PMD incrementally across remaining core modules

## Summary

A full root PMD baseline with PMD 7.25.0 produced 5,551 findings across 53 source-bearing subprojects after generated files below `build/` were excluded. Four subprojects produce clean PMD XML today and can be protected immediately; the remaining modules need incremental cleanup before joining the blocking allowlist.

## Reproduction

```shell
./gradlew aggregateAnalysisViolations --continue \
-Pgrails.code-analysis.enabled.pmd=true \
-Pgrails.code-analysis.ignoreFailures=true
```

Reports are written under `build/reports/code-analysis/pmd/`.

## Baseline

Largest current groups:

| Project | Findings |
|---------|---------:|
| `grails-core` | 699 |
| `grails-datastore-core` | 698 |
| `grails-web-common` | 585 |
| `grails-data-hibernate5-core` | 549 |
| `grails-gsp-core` | 289 |
| `grails-data-mongodb-core` | 288 |
| `grails-encoder` | 269 |
| `grails-datamapping-core` | 254 |
| `grails-converters` | 213 |
| `grails-web-url-mappings` | 211 |
| Remaining 43 projects | 1,496 |
| **Total** | **5,551** |

The current clean, report-producing baseline is:

- `:grails-data-graphql-core`
- `:grails-data-mongodb-spring-data`
- `:grails-datasource`
- `:grails-testing-support-core`

`:grails-scaffolding`, `:grails-spring-security`, and `:grails-spring-security-acl` have no PMD-analyzable Java source. Their PMD tasks legitimately produce no XML, so they are not counted as clean or added to blocking enforcement.

## Suggested approach

Clean one independently buildable subproject at a time. After a subproject reaches zero findings and produces its expected PMD XML report, add its full project path to `grails.code-analysis.enabled.pmd.projects` so regressions become blocking immediately.

Do not disable PMD rules globally to clear this backlog. If a rule is invalid for Grails/Groovy-generated Java, document and scope that exception to the affected source set or file pattern.

## Acceptance criteria

- Each remaining source-bearing root subproject has zero PMD findings.
- Each cleaned, report-producing subproject is added to the PMD project allowlist in the same change.
- Module tests and `aggregateAnalysisViolations` pass after every staged addition.

Run ./gradlew aggregateAnalysisViolations --continue with PMD enabled and inspect reports under build/reports/code-analysis/pmd/. Work through one independently buildable source-bearing subproject at a time, then add each clean report-producing project to grails.code-analysis.enabled.pmd.projects. Done means every remaining source-bearing project has zero findings and module tests plus aggregateAnalysisViolations pass.

Written by the indexing model from the issue text.