Patch Tomcat dependency to unblock Docker build vulnerability gate

[Copilot]

The Docker build job was failing at the Trivy scan stage due to CRITICAL vulnerabilities in the transitive Tomcat runtime (tomcat-embed-core resolved to 11.0.22). This updates dependency resolution to a patched Tomcat line so the container image no longer fails the security gate on that component.

• Root cause

  • CI’s Docker/Trivy step flagged CRITICAL CVEs in org.apache.tomcat.embed:tomcat-embed-core from the Spring Boot-managed default version.

• Change applied

  • Added an explicit Maven property override in pom.xml under existing security overrides:
    • tomcat.version → 11.0.25

• Dependency management impact

  • Keeps the change surgical (no parent/BOM migration), while forcing patched Tomcat artifacts across Spring Boot starters that consume embedded Tomcat.

<!-- Security overrides -->
<netty.version>4.2.16.Final</netty.version>
<httpcore5.version>5.4.3</httpcore5.version>
<tomcat.version>11.0.25</tomcat.version>