[SebastianKrn]

Intent

Close the open findings of the image scan and CodeQL's workflow-permission alerts, without touching behaviour. Goal served: the public demo must not carry known CRITICAL findings it could fix with a patch bump.

Changes

• modern/pom.xml: tomcat.version 11.0.24 → 11.0.25 (CVE-2026-65182, -65905, -68525, CRITICAL), jackson-bom.version 3.1.5 → 3.1.7 (CVE-2026-89407, -89425, -68497, -91776, -91777, HIGH), org.postgresql:postgresql 42.7.12 → 42.7.14 (closes chore(deps): Bump org.postgresql:postgresql from 42.7.12 to 42.7.14 in /modern #101; testbed pom moved too, otherwise PomDriftGuardTest stays red as on chore(deps): Bump org.postgresql:postgresql from 42.7.12 to 42.7.14 in /modern #101).
• Deviation from the brief (Jackson 3.2.2): Trivy lists -89425, -91776 and -91777 as fixed in 3.1.7, 3.2.3, so 3.2.2 would leave three HIGH findings open. 3.1.7 closes all five and stays on Boot 4.1.1's managed minor — a patch, not a minor jump, on the library that carries the wire format ADR-0005 pins. Same rule as the 42.7.12 pin: minimum fixed version, Dependabot owns drift.
• permissions: contents: read in ai-testgen, ci, e2e, legacy-ci, modern-ci, playbook (CodeQL alerts 1–8). No job writes; artefact upload and cache use the runtime token.

Gherkin

Given the modern image built from this branch
When Trivy scans it for fixable CRITICAL/HIGH findings
Then the jar reports 0 findings
And all equivalence gates (characterization 47/47 on both stands, e2e 34/34 on both stands) stay green

Evidence

CI of this PR (modern-build Trivy table, characterization vs modern, e2e both stands). DEVIATIONS row updated with the measured count in a follow-up commit on this branch.

Debt taken

Go stdlib findings in /usr/bin/pebble (shipped by the eclipse-temurin:25-jre / Ubuntu 26.04 base image, not by us) stay open until the base image is rebuilt with Go ≥ 1.27.3.

Open

Drop the two property overrides once a Boot 4.1.x parent manages these versions.