Triage the existing SpotBugs finding baseline

## Summary

A provisional root SpotBugs baseline produced 287 `BugInstance` entries across 51 module reports. The count is provisional because the broad run also hits separate task-wiring and detector failures, but the valid XML findings should be triaged once execution is stable.

## Reproduction

```shell
./gradlew aggregateAnalysisViolations --continue \
-Pgrails.code-analysis.enabled.spotbugs=true \
-Pgrails.code-analysis.ignoreFailures=true
```

Reports are written under `build/reports/code-analysis/spotbugs/`.

## Largest current groups

| Project/report | Findings |
|----------------|---------:|
| `grails-shell-cli-spotbugsMain` | 26 |
| `grails-spring-security-ui-spotbugsMain` | 21 |
| `grails-rest-transforms-spotbugsMain` | 18 |
| `grails-spring-security-spotbugsMain` | 17 |
| `grails-datamapping-core-spotbugsMain` | 16 |
| `grails-bootstrap-spotbugsMain` | 14 |
| `grails-fields-spotbugsMain` | 14 |
| `grails-data-mongodb-bson-spotbugsMain` | 13 |
| `grails-data-mongodb-core-spotbugsMain` | 13 |
| `grails-data-hibernate5-core-spotbugsMain` | 12 |
| Remaining reports | 123 |
| **Total** | **287** |

## Suggested approach

After the SpotBugs execution issue is resolved, regenerate the baseline and triage findings by bug pattern and module. Fix true defects first. Scope exclusions only to demonstrated generated-code false positives, with comments and tests. Add clean modules to a SpotBugs project allowlist incrementally.

## Acceptance criteria

- The baseline is regenerated after SpotBugs completes without infrastructure errors.
- Every finding is fixed or has a narrow, documented false-positive exclusion.
- Each clean module is added to staged blocking SpotBugs enforcement.
- Relevant module test suites pass after each cleanup batch.

First resolve the SpotBugs execution issue, then run the documented ./gradlew aggregateAnalysisViolations command and inspect reports under build/reports/code-analysis/spotbugs/. Triage the valid XML findings by bug pattern and module, fixing true defects or documenting narrow generated-code exclusions with tests. Done means the baseline regenerates cleanly, every finding is addressed, clean modules enter staged blocking enforcement, and relevant module suites pass.

Written by the indexing model from the issue text.