fix(QTDI-3165): CVE-202654512 bump jackson to 2.21.5

[undx]

Requirements

• Any code change adding any logic MUST be tested through a unit test executed with the default build
• Any API addition MUST be done with a documentation update if relevant

Why this PR is needed?

What does this PR adds (design/code thoughts)?

AI generated code

https://internal.qlik.dev/general/ways-of-working/code-reviews/#guidelines-for-ai-generated-code

• [] this PR has been written with the help of GitHub Copilot or another generative AI tool

[Copilot]

Pull request overview

Updates the root Maven dependency version properties to address a reported Jackson CVE by bumping the Jackson versions used across the build.

Changes:

• Bump jackson-core and jackson-databind properties from 2.21.2 to 2.21.5.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonar-rnd]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• No data about coverage (0.00% Estimated after merge)
• 0.00% Duplicated Code (1.50% Estimated after merge)

Project ID: org.talend.sdk.component:component-runtime

View in SonarQube

[ozhelezniak-talend]

lgtm
but connectors repos on 2.22 already
maybe it's better to align with them if we don't have a limitations? (cloud or smth like that)

[undx]

lgtm but connectors repos on 2.22 already maybe it's better to align with them if we don't have a limitations? (cloud or smth like that)

In fact, we use the less possible jackson in repo, it's mainly a transitive dep from beam/cloud related features.
There's no direct use in framework itself...