[loong10k]

Jackson 2.17.2 is affected by later security advisories. Align the Jackson 2.x components with the 2.18.12 LTS BOM instead of carrying over PR #4's incompatible Spring Security 6 migration. No production Java source, public javax.servlet signature, authentication default, Spring Security version, or coverage rule is changed.

Add offline JSON/JWT regressions for Unicode/numeric claims in a signed JWT, malformed JSON, disabled default polymorphic typing, excessive nesting, and the unauthenticated token trust boundary. Pin Surefire and reject zero-test runs. CI now builds fixed public Easy4J revisions with their tests instead of installing floating main snapshots with tests/coverage disabled; Maven Central-only settings avoid private credentials.

Validation on JDK 17 / Maven 3.9.16:

• jwt-issuer fe29ffd8471eff70d2117b73e4cb2459e5ec4a2f: full clean install passed (2 tests).
• spring-security-extension 385e4ae3b16f369c94a9068afcb27fca47494767: full clean install FAILED during test compilation (missing JUnit Jupiter, Mockito and Spring Test). Its production compilation succeeds.
• Diagnostic only: after installing that upstream with tests skipped, this project's clean verify passed all 35 tests with 70/70 covered lines. This does NOT validate the full dependency chain. The original 90% / haltOnFailure=false coverage rule remains unchanged.
• dependency:tree resolves Jackson databind/core/annotations to 2.18.12.

BLOCKED — keep draft, do not merge:

1. Fix and fully test the upstream security-extension source before accepting its snapshot.
2. Resolve the existing incompatible runtime dependency graph without changing this project's public Servlet API: core/web 5.6.0 and Spring 5 coexist with config/messaging/aspects 6.4.4 and Spring Messaging 6.2.4 from upstream. Passing this project's small unit suite cannot establish runtime compatibility. No cross-generation migration was attempted.
3. Run remote CI after the above blockers are resolved. The full upstream CI step is expected to remain red until then.

Security sources: https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.18.12 and GHSA-m8xf-2cr7-77ph . This patch supersedes only the Jackson portion of #4, not its other dependency updates.