fix: register the resync filter only when spring-web is present

[totally-not-ai]

Summary

The starter no longer compiles against Flow 25.4, because spring-web stopped coming in through vaadin-spring. This PR adds spring-web to the starter as an optional dependency. It also creates the resync detection filter only when spring-web is on the classpath, so the rest of the starter still works without it.

What changed

• Behavior change: The SpringResyncDetectionFilter registration bean is now created only when OncePerRequestFilter (from spring-web) is on the classpath. Only apps without spring-web are affected: they no longer get the filter, and the app starts normally instead of failing. Apps that use Spring MVC see no change.
• observability-kit-starter/pom.xml: spring-web is now declared as an optional dependency. Before, the starter got it through vaadin-spring, but vaadin-spring 25.4 declares spring-webmvc as provided.
• ObservabilityAutoConfiguration: the resyncDetectionFilter bean moved into a nested ResyncDetectionFilterConfiguration class guarded by @ConditionalOnClass(OncePerRequestFilter.class). Its other conditions are the same as before: it needs a MeterRegistry bean, backs off if you define your own bean, and turns off with vaadin.observability.resync=false.

Test summary

Resync detection filter auto-configuration:

• Filter registered when spring-web is present
• No filter when OncePerRequestFilter is missing from the classpath
• Context still starts and the metrics listener is still created without spring-web

[Artur-]

This is probably not needed at all if the related Flow PR is merged

[totally-not-ai]

@Artur- Agreed. If vaadin/flow#25960 merges, the kit can count resent, resync and message id errors from the new service events. Then SpringResyncDetectionFilter and the request body re-parsing are no longer needed, and neither is the spring-web dependency or the conditional registration in this PR. I haven't changed anything yet: #25960 is still open, and main already compiles against 25.4 with the plain spring-web dependency from #413. I suggest we keep this PR on hold. Once #25960 lands, I'll replace the filter with a service event listener and close this PR.