Mitigate CVE-2025-24813 by pinning patched Tomcat and hardening embedded servlet behavior

[Copilot]

This PR addresses the critical Tomcat partial PUT vulnerability path (CVE-2025-24813), which can enable RCE, information disclosure, or content corruption when write-capable default servlet behavior is exposed. It updates runtime Tomcat resolution and hardens embedded Tomcat request/servlet settings to reduce exploitability.

• Dependency remediation

  • Pin Tomcat to a patched line by setting:
    • extra["tomcat.version"] = "9.0.99"
  • Ensures Spring Boot’s embedded Tomcat modules resolve to a fixed tomcat-embed-core version instead of the vulnerable baseline.

• Embedded Tomcat hardening

  • Add TomcatSecurityConfig with a WebServerFactoryCustomizer<TomcatServletWebServerFactory> to:
    • Disable partial PUT handling via connector property:
      • allowPartialPut=false
    • Enforce read-only default servlet behavior:
      • readonly=true on the default servlet wrapper

factory.addConnectorCustomizers(connector ->
    connector.setProperty("allowPartialPut", "false"));

factory.addContextCustomizers(context -> {
    Container defaultServlet = context.findChild("default");
    if (defaultServlet instanceof Wrapper) {
        ((Wrapper) defaultServlet).addInitParameter("readonly", "true");
    }
});