Remediate embedded Tomcat HTTP/2 DoS exposure by pinning patched 9.0.x line

[Copilot]

This change addresses a high-severity Apache Tomcat HTTP/2 denial-of-service vulnerability (CVE-2024-34750) affecting stream accounting and connection timeout behavior under excessive headers. The service now resolves embedded Tomcat to a patched 9.0.x version to remove vulnerable artifacts from runtime.

• Dependency remediation

  • Introduced an explicit Gradle property override to force Spring Boot-managed Tomcat modules onto a patched release.
  • Set tomcat.version to 9.0.118, ensuring tomcat-embed-core resolves above the vulnerable range and aligns companion embed modules on the same version line.

• HTTP/2 configuration impact

  • No explicit Tomcat HTTP/2 connector/protocol overrides exist in the codebase, so no config migration was required.
  • Existing application behavior and service-level settings remain unchanged outside dependency resolution.

// build.gradle.kts
extra["tomcat.version"] = "9.0.118"