Nox plugin

Support for Minecraft 1.21.9 and newer, tested through 26.2. Requires Java 21. Minecraft 1.21.8 and
older are served by version 1.0.1.

The split sits at 1.21.9 because ProtocolLib has no release beyond 1.21.8: from that version on,
only the Paper backend added here can rewrite the version label, tooltip, hidden slots and fake
online count.

### Added
- [x] added: Paper backend, used automatically when the server runs Paper
- [x] added: Backend detection at startup, logging which one is in use
- [x] added: `/nox` with no argument lists the commands available to the sender
- [x] added: Unit tests for version ordering and the hex/gradient parser

### Changed
- [x] changed: Java 16 → 21, Kotlin 1.6 → 2.4, Gradle 7.0 → 9.7
- [x] changed: ProtocolLib is now the fallback for plain Spigot only (it stops at Minecraft 1.21.8)
- [x] changed: Hex and gradient colours no longer go through the deprecated bungeecord-chat library
- [x] changed: Update check runs off the main thread and is cached for the join message
- [x] changed: `defaults/config.yml` is now the standard Bukkit `config.yml`

### Fixed
- [x] fixed: Update checker reported the oldest release instead of the newest
- [x] fixed: Random MOTD never picked the last entry and threw on single-entry lists
- [x] fixed: `%banDate%` and `%banSource%` returned each other's value
- [x] fixed: Banned MOTD matched the reverse-DNS hostname, so IP bans rarely matched
- [x] fixed: Fake online count and hidden slots were never applied by the ProtocolLib backend
- [x] fixed: Gradients dropped their last character
- [x] fixed: Single-colour gradient tags and very short gradients threw during the ping
- [x] fixed: Update notice overwrote the server-wide join message instead of messaging the operator
- [x] fixed: Join listener performed a blocking HTTP call on the main thread
- [x] fixed: Version suffix in CI used the long-removed `CI_BUILD_REF_NAME` variable
- [x] fixed: `fakeOnlineFixedEnabled`, `fakeOnlineMultiply` and `fakeOnlineMultiplyEnabled` wrote to
      the wrong configuration key, so they changed an unrelated setting
- [x] fixed: `jar` and `shadowJar` wrote to the same file, so the published jar could end up without
      its bundled dependencies depending on task order