Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation

[labkey-willm]

Rationale

LabKey Server's OWASP Dependency Check build is failing on develop with 124 findings, the bulk of them from a handful of vulnerable third-party dependencies. This PR clears the findings that can be resolved by version bumps/forces and suppresses two verified false positives.

this is a backport from develop

Related Pull Requests

• Update Tomcat, HttpCore5, Jackson for OWASP CVE remediation #1438

Changes

• Tomcat 11.0.22 -> 11.0.23: CVE-2026-53434 and CVE-2026-55276 (CRITICAL 9.1), plus CVE-2026-53404, CVE-2026-55955, CVE-2026-55956, CVE-2026-50229
• httpcore5 5.4.2 -> 5.4.3, and a new httpcore5-h2 force at 5.4.3 (previously transitive at 5.3.6): CVE-2026-54399
• Jackson 2.21.4 -> 2.21.5 (jacksonVersion, jacksonDatabindVersion, jacksonJaxrsBaseVersion): CVE-2026-54515
• Suppress classic httpcore 4.x for CVE-2026-54399 (the CVE is scoped to HttpComponents Core 5.x; the 4.x line is EOL and unaffected)
• Suppress Kotlin runtime jars for CVE-2026-53914 (a Kotlin build-cache-metadata deserialization flaw scored 6.7 MEDIUM by JetBrains, not applicable to the shipped stdlib/reflect runtime jars)
• Update comments to document that apacheTomcatVersion is intentionally held ahead of Spring Boot's managed Tomcat