Fix DevCenter cards silently emitting zero rows

[jkschneider]

Summary

The five dependency-version DevCenter cards — LibraryUpgrade, GroovyVersionUpgrade, KotlinVersionUpgrade, ScalaVersionUpgrade, ParentPomUpgrade — currently produce zero rows. The "Move to Spring Boot 4.0" card, for example, shows no data even on repos that clearly use Spring Boot.

Root cause

These cards read dependency versions by running a sibling recipe (DependencyInsight / ParentPomInsight) for the side effect of writing a row to its data table, then capturing the row via DataTableRowWatcher. DependencyInsight.MarkIndividualDependency adds SearchResult markers to the LST, which forces OpenRewrite to schedule a cycle 2. On cycle 2, DataTable#insertRow silently drops every write whose DataTable doesn't override allowWritingInThisCycle — and DependenciesInUse / ParentPomsInUse don't. The watcher's getRows() snapshot diff comes back zero, and the cards emit nothing.

• This worked before Adapt to new DataTables interface #61 ("Adapt to new Data Table interface") — the previous DataTableRowWatcher read from the ungated org.openrewrite.dataTables context-message bag rather than the cycle-gated DataTableStore.

Fix

Replace the sibling-recipe + watcher pattern with direct reads from LST markers via MavenResolutionResult.findDependencies(...) and ResolvedDependency.findDependencies(...). A shared helper ResolvedDependencyVersions.findVersions(SourceFile, groupIdPattern, artifactIdPattern) walks both Maven and Gradle markers; the four version-card recipes route through it.

• ParentPomUpgrade reads Pom.getParent() for immediate-parent matching only — drops the recursive ancestor walk that ParentPomInsight did via MavenPomDownloader. DevCenter cards typically want to track the closest parent (e.g. a corporate parent that extends spring-boot-starter-parent); if there's a use case for transitive grand-parent matching, happy to add it back.
• DependencyVulnerabilityCheck uses the new DependencyVulnerabilityCheckBase#vulnerabilities(Accumulator) accessor (companion PR moderneinc/rewrite-java-security#354) to avoid the same coupling.
• DataTableRowWatcher is deleted; no remaining consumers.

Tests previously asserted on <!--~~(...)~~>-- SearchResult markers from the now-removed sub-recipe runs; those assertions are dropped.

Test plan

• ./gradlew :test --tests 'LibraryUpgradeTest' --tests 'GroovyVersionUpgradeTest' --tests 'KotlinVersionUpgradeTest' --tests 'ScalaVersionUpgradeTest' --tests 'ParentPomUpgradeTest' — all pass locally
• End-to-end: mod git sync moderne ./working-set Default && mod run --recipe=io.moderne.devcenter.DevCenterStarter && mod devcenter produces non-empty "Move to Spring Boot 4.0" rows
• CI green

Dependency

• Requires moderneinc/rewrite-java-security#354 to be released before this can compile against the published artifact (CI will fail until then).