LUCENE-9077 added forbiddenapis also to Gradle. The signatures files were selected based on the resolved artifacts.
Solr also uses commons-io (currently version 2.6)but in contrast to Ant build, the signatures shipped with forbiddenapis are not applied. This was an oversight as those signatures are special: we have to check the artifacts and if commons-io is part of configuration, we add the bundled signature.
This can be done at the same place where the dynamic signatures for other libraries are added.