[360608]

Raises dependency versions that OSV/GHSA report as vulnerable in modules/flowable-dependencies/pom.xml. All are patch-level bumps within the same minor line.

Property	From	To	Advisories on old version
jackson.version	2.21.3	2.21.8	16
jackson3.version	3.1.3	3.1.8	15
spring.framework.version	7.0.7	7.0.10	1
mariadb.version	3.5.8	3.5.11	4
postgresql.version	42.7.11	42.7.14	1

OSV reports no advisories for the new versions.

Not included: httpclient5 5.6.1 has one advisory fixed in 5.6.3, but moving to 5.6.5 made 10 tests in flowable-http fail with TLS errors (No name matching localhost found), so it needs separate investigation. Apache CXF is in a separate PR.

Spring Boot (4.1.0-RC1) and Spring Security (7.1.0-RC1) are unchanged. The pom comment says to update the Spring versions together; only Spring Framework changed here, so please say if you would rather bump the others together.

Testing: full mvn -Pdistro install across all modules passes. Three tests were excluded from that run: CallActivityTypeConversionTest and the CMMN TypeConversionTest fail on main today regardless of this change, because they assert that a "10 day" period lies between 239h and 240h01m, which fails now because US daylight saving ends before the 10-day window does (it is 241h); that is fixed in #4316. BoundaryTimerEventTest has a 100 ms timing assertion that failed once under load and passed on rerun; it is a separate flake.

[360608]

@dbmalkovsky @filiphr @tijsrademakers @jbarrez - could you please review this change? It bumps Jackson, Jackson 3, Spring Framework and the MariaDB and PostgreSQL drivers to patched versions; OSV scans flag the current versions with known CVEs, and 8.0.0 users are asking for a release that clears security reviews. The full mvn -Pdistro install build passes. Thank you!