Spring for Apache Kafka 4.0

Apply the Spring Boot 4.0 baseline first. These rules cover the Spring Kafka 4.0 line at 4.0.7, which builds on Java 17 or later, Spring Framework 7.0.9, and Apache Kafka clients 4.1.2, and which ships both the deprecated Jackson 2 classes and their Jackson 3 replacements.

Line-specific changes

• Decide explicitly whether the application runs on Jackson 2 or Jackson 3: 4.0 prefers Jackson 3 for its default header mapper when it is on the classpath; explicitly configured JsonDeserializer instances remain Jackson 2, and both deserializer families use the same spring.json.* property names.
• Configure trusted packages, type mappings, and header trust on the classes actually in use — JacksonJsonSerializer/JacksonJsonDeserializer, JacksonJsonSerde, DefaultJacksonJavaTypeMapper, and JsonKafkaHeaderMapper on Jackson 3; the deprecated JsonSerializer/JsonDeserializer, JsonSerde, DefaultJackson2JavaTypeMapper, and DefaultKafkaHeaderMapper on Jackson 2. A hardened Jackson 2 ObjectMapper does not protect a Jackson 3 deserializer.
• Treat the ZooKeeper removal as a deployment change, not just a test change: Kafka 4.x brokers and the 4.0 embedded test broker are KRaft-only, EmbeddedKafkaZKBroker and EmbeddedKafkaRule are gone, and @EmbeddedKafka no longer accepts zookeeperPort, zkConnectionTimeout, or zkSessionTimeout, so review KRaft ACL configuration when upgrading the brokers; client upgrades alone do not require a KRaft broker.
• Spring Retry is no longer a dependency; retry configuration moved to Spring Framework's BackOff and Spring