JCRVLT-863 : bump required Jackrabbit libraries to 2.20.18

[rishabhdaim]

Summary

Backport #438 to the Java 8 maintenance branch, raising the production Jackrabbit libraries to 2.20.18 and documenting the requirement in README.txt.

Branch adaptations

• Update the existing jackrabbit.version property rather than introducing the newer min/max scheme. JCR Commons, SPI, SPI Commons, JCR2SPI, JCR Client, SPI2DAV and WebDAV resolve to 2.20.18.
• Keep the standalone Jackrabbit API and test repository at 2.16.3 through separate properties, preserving the Oak 1.6.1 test stack. There is no jackrabbit-api:2.20.18 artifact; migrating to oak-jackrabbit-api is outside this backport's scope.
• Preserve the existing OSGi import policy and legacy build conventions.
• Do not introduce README.md, the dependency-check plugin, or suppressions.xml, none of which exists on 3.2.x. The source PR's scanner update and suppression cleanup therefore do not apply here.

Verification

• All reactor modules and their tests compile with Java 8 (mvn -DskipTests test-compile).
• All current-source vault-core tests: 686 cases per backend, zero failures/errors; 14 Oak and 18 Jackrabbit skips.
• Effective dependency-tree and managed-version checks confirm upgraded production libraries and retained API/test backend versions.
• Diff checks pass. Spotless is not configured on this branch.

Links

• https://issues.apache.org/jira/browse/JCRVLT-863
• Source: JCRVLT-863 Bump minimum required JR2 version to 2.20.18 #438

Co-Authored-By: GitHub Copilot copilot@github.com