Source all codeanalyzer-* from PyPI; kill bundled bin/jar dirs

[rahlk]

No more vendored binaries in the repo. Each analyzer resolves from its
PyPI package:

• codeanalyzer-python: in-process lib (already)
• codeanalyzer-typescript: bin_path() from the wheel
• codeanalyzer-java: python -m codeanalyzer_java

Removed cldk/analysis/typescript/codeanalyzer/bin/ (dead) and
cldk/analysis/java/codeanalyzer/jar/. Dropped dead bundled-bin
fallbacks. Pins: codeanalyzer-typescript 0.2.1->0.4.0, added
codeanalyzer-java 2.3.7, codeanalyzer-python 0.1.14.

[rahlk]

Closing as won't-do, and recording the reason so it isn't re-proposed.

The Java backend was deliberately reverted to the bundled jar because of GraalVM issues — see #161. That removes the premise of this issue: codeanalyzer-python and codeanalyzer-typescript are already ordinary PyPI dependencies, so "source all codeanalyzer-* from PyPI" is already true for everything except Java, and Java's exception is intentional rather than leftover.

The bundled cldk/analysis/java/codeanalyzer/jar/ directory therefore stays, and release.yml deliberately guards that it is present in the built wheel.

Worth revisiting only if GraalVM native-image support improves enough to make a native codeanalyzer-java viable. Related: JDK provisioning is tracked in #237.