Pin kotlinx-io and kotlinx-serialization to their last Kotlin 2.2 releases

[jcopenhop]

Problem

sarif4k 0.7.0 can't be consumed by projects still building with Kotlin 2.1.
The most concrete case is detekt itself: its Gradle plugin performs SARIF
report merging via sarif4k, but the Detekt Gradle Plugin is compiled against
kotlin-gradle-plugin-api 2.1.0 (its supported floor). Kotlin 2.1 refuses
to read dependency metadata compiled at language version 2.3, so the plugin
fails to compile against sarif4k 0.7.0. This currently blocks detekt from
upgrading — see detekt/detekt#9330 and detekt/detekt#9247.

Root cause

sarif4k's own classes are already emitted at metadata version 2.2 (the build
pins languageVersion/apiVersion/coreLibrariesVersion to 2.2), so they're
fine. The blocker is the api-exposed transitive dependencies, which were
compiled at language version 2.3:

• kotlinx-io-core 0.9.x
• kotlinx-serialization-json / -json-io 1.10.x+

Because these are on the public API surface, consumers must read their metadata
too — and Kotlin 2.1 can't.

Fix

Hold these dependencies at their last Kotlin 2.2-built releases, so the entire
published API surface stays at metadata version 2.2 (readable by Kotlin 2.1):

Dependency	Before	After
kotlinx-io-core	0.9.0	0.8.2
kotlinx-serialization-json	1.11.0	1.9.0
kotlinx-serialization-json-io	1.11.0	1.9.0

Also adds Renovate packageRules (allowedVersions) so these aren't
auto-bumped back past the 2.2 line and silently reintroduce the incompatibility.

Verification

• ./gradlew clean jvmTest checkKotlinAbi — green; public ABI unchanged
  (no api/*.api regeneration needed), streaming serializer unaffected by the
  older kotlinx-io.
• Metadata check: sarif4k's own classes and all three downgraded deps now emit
  @Metadata(mv=[2,2,0]).
• Published locally and compiled detekt's Gradle plugin against it with
  org.gradle.kotlin.dsl.skipMetadataVersionCheck=false (metadata checking on):
  :detekt-gradle-plugin:compileKotlin and :test both pass, resolving
  sarif4k 0.7.0-SNAPSHOT → kotlinx-io 0.8.2 / serialization 1.9.0.