Bump spotbugs 4.7.6->4.9.0 and gradle plugin:4.6.1->6.1.3

This required a bit of a messy workaround to get the effort
set.

gradle/check.gradle

@@ -68,18 +68,23 @@ quickCheck.dependsOn checkstyleMandatory
 
 // SpotBugs
 apply plugin: 'com.github.spotbugs'
-
+// It looks like there is an issue with having spotbugs in a separate file
+// https://github.com/spotbugs/spotbugs-gradle-plugin/issues/972
+def classLoader = plugins['com.github.spotbugs'].class.classLoader
+def SpotBugsEffort = classLoader.findLoadedClass( 'com.github.spotbugs.snom.Effort' )
 spotbugs {
     toolVersion = libs.versions.spotbugs.get()
     ignoreFailures = false
-    effort = 'max'
+    effort = SpotBugsEffort.MAX
     excludeFilter = rootProject.file('gradle/codequality/spotbugs_exclude.xml')
 }
 
 spotbugsTest.enabled = false
 
 def spotbugsFailed = false
 
+// TODO we may be able to remove this, as it should now print to stdout
+// https://github.com/spotbugs/spotbugs-gradle-plugin/commit/b78a1b349487031590e281fe17c7ed5c245d42ae
 def printInstructionsOnRunningWithHtmlOutput = task('printInstructionsOnRunningWithHtmlOutput') {
     doLast {
         if (spotbugsFailed) {

gradle/libs.versions.toml

@@ -70,7 +70,7 @@ snakeyaml = "2.2"
 # Static analysis dependency versions
 
 jacoco = "0.8.5"
-spotbugs = "4.8.6"
+spotbugs = "4.9.0"
 
 [libraries]
 
@@ -158,5 +158,6 @@ protobuf = { id = "com.google.protobuf", version = "0.8.19" }
 serviceloader = { id = "com.github.harbby.gradle.serviceloader", version = "1.1.8" }
 shadow = { id = "com.github.johnrengelman.shadow", version = "7.1.2" }
 sonarqube = { id = "org.sonarqube", version = "3.3" }
-spotbugs = { id = "com.github.spotbugs", version = "4.6.1" }
+# TODO go through spotbugs updates themselves, 4.6.1 used spotbugs 4.2.1, 6.1.3 uses 4.9.0
+spotbugs = { id = "com.github.spotbugs", version = "6.1.3" }
 versions = { id = "com.github.ben-manes.versions", version = "0.38.0" }