Dear Emmanuel,
Yes, that works in this case.
For the benefit of anyone with a similar problem, the issue arises in this case because by default, gradle-debian-helper only applies its ruleset if the version isn't already generic (i.e. 'debian' or ends in '.x'). Since the transitive dependency org.apache.commons:commons-lang already has a generic version 3.x, the maven.rules are not applied, so I cannot override the version there.
An alternative approach would be to use quilt to patch the build.gradle file to include: