fix: bump default spotbugs version from 4.7.1 to 4.7.2

[KengoTODA]

Thanks for merging #782!

When we bump up the dependency on spotbugs-core, it is better to:

1. update the README.md to tell the mapping between versions of gradle-plugin and spotbugs-core,
2. trigger a release by make a commit with fix: prefix

Please merge this PR by squash and merge and make sure its commit message starts with fix: then next release will be made by Gradle automatic.

[KengoTODA]

IDEA did a magic so many lines are got affected, however, what actually changed is here: simply added a mapping 5.0.13 to 4.7.2.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[hazendaz]

@KengoTODA Thanks for addition information here. Appreciate it!

[github-actions]

🎉 This PR is included in version 5.0.12 🎉

The release is available on:

• 5.0.12
• GitHub release

Your semantic-release bot 📦🚀

[hazendaz]

@KengoTODA Can you explain a bit better here as to why 'fix' is used? Why not 'release' as a prefix as we want to release it. Are there different types with this setup already? What foo magic is making this happen? Others have done this on spotbugs plugin and it releases nothing. So its confusing at best. It should be directly documented as release steps and IMHO, it should not be happening on master even. Everyone raises PRs to master, if I did not know about this now, what was to stop some rouge user from raising a PR with 'fix' on it causing it to release on us.