[1.16] Fix/bump deps CVE 1.16

[javier-aliaga]

Description

Upgrades multiple dependencies to address critical, high, and medium severity CVEs identified by Snyk, while keeping Spring Boot at 3.4.13 for backward compatibility.

Dependency Changes

Dependency	From	To	CVE(s)
Jackson 2.x (via jackson-bom)	2.18.6	2.21.2	Resource allocation DoS (SNYK-JAVA-COMFASTERXMLJACKSONCORE-15907551, -15365924)
Spring Framework (via BOM)	6.2.15	6.2.17	Injection (SNYK-JAVA-ORGSPRINGFRAMEWORK-15701755), Directory traversal (SNYK-JAVA-ORGSPRINGFRAMEWORK-15701845)
Logback	1.5.22	1.5.25	External init of trusted vars (SNYK-JAVA-CHQOSLOGBACK-13169722, -15062482)
Tomcat Embed	10.1.50	10.1.52	Improper cert validation (SNYK-JAVA-ORGAPACHETOMCATEMBED-15307781), Incorrect auth (-15307822)
AssertJ	3.27.3	3.27.7	XXE Injection (SNYK-JAVA-ORGASSERTJ-15102413)
Commons Compress	1.24.0	1.26.0	Infinite loop + DoS (SNYK-JAVA-ORGAPACHECOMMONS-6254296, -6254297)
Commons Codec	(not present)	1.17.2	Required at runtime by commons-compress 1.26.0 (optional transitive)

Approach

• Spring Boot stays at 3.4.13 to maintain backward compatibility with users on SB 3.4.x.
• jackson-bom and spring-framework-bom imported before the Spring Boot BOM in all modules with their own dependencyManagement (sdk-springboot, sdk-tests, spring-boot-examples, dapr-spring) to ensure consistent version resolution.
• Removed explicit ${jackson.version} from sdk-workflows/pom.xml and sdk/pom.xml — versions are now managed by the jackson-bom.
• Commons Codec 1.17.2 added as direct dependency in testcontainers-dapr since commons-compress 1.26.0 declares it as optional but testcontainers requires it at runtime.

Known Remaining (unfixable on 1.16)

• grpc-netty-shaded@1.69.0 — bundles Netty 4.1.130 internally (shaded jar). Our netty-bom 4.1.132 override cannot reach inside the shaded jar. Requires gRPC 1.75.0+ which is a breaking change.
• Spring Boot Actuator auth bypass — in example apps only, requires SB 3.5.x.

Test plan

• CI unit tests pass
• Integration tests pass
• snyk test --all-projects returns only grpc-netty-shaded and actuator CVEs

Issue reference

We strive to have all PR being opened based on an issue, where the problem or feature have been discussed prior to implementation.

Please reference the issue this PR will close: #[issue number]

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

• Code compiles correctly
• Created/updated tests
• Extended the documentation

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-1.16@7fa6e6a). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff               @@
##             release-1.16    #1717   +/-   ##
===============================================
  Coverage                ?   79.61%           
  Complexity              ?     2089           
===============================================
  Files                   ?      256           
  Lines                   ?     6386           
  Branches                ?      662           
===============================================
  Hits                    ?     5084           
  Misses                  ?      957           
  Partials                ?      345           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.