Bump the Spring Boot checkout example past the open Trivy advisories

[gerardrecinto]

The Trivy filesystem scan now fails every PR: 36 HIGH/CRITICAL findings, all in bindings/java/examples/spring-boot-checkout-store/pom.xml, which pins Spring Boot 3.3.4 (Tomcat 10.1.30, Jackson 2.17.2, Spring Framework 6.1.13). The file has not changed since Sep 15, and master's scan passed on Oct 1, so newly published advisories tripped it.

Changes, all in that one pom:

• Spring Boot parent 3.3.4 to 3.5.16.
• tomcat.version pinned to 10.1.60. Boot 3.5.16 still manages 10.1.55, which has open CRITICAL advisories fixed in 10.1.58 and later. 10.1.58 itself is not on Maven Central, so 10.1.60 is the latest published.
• jackson-bom.version pinned to 2.21.7, which fixes the Jackson advisories Boot 3.5.16 (2.21.4) still carries. Matches the Jackson version already used elsewhere in the repo.

The two overrides carry a comment to drop them once the parent catches up.

Checked locally:

• mvn test-compile and mvn test pass (BUILD SUCCESS). The example has no tests, so this covers compilation only.
• mvn dependency:tree resolves Boot 3.5.16, Tomcat 10.1.60, jackson-databind and jackson-core 2.21.7.
• trivy fs --severity CRITICAL,HIGH --ignore-unfixed on the example: 36 findings before, 0 after.

Not checked: running the app end to end. It needs the native sop4j library built locally, which I did not set up. No CI job builds this example.

Thanks, Gerard Recinto

[github-actions]

Gemini PR Review

Reviewed commit: 6d1739a3b7b5d69a80b6e707fb8ddc840bb71fd4
Verdict: PASS

There are no actionable findings.