GHSA-r7wm-3cxj-wff9 CVE-2026-54512 CVE-2026-54513 Upgrade Jackson to 2.18.9

[vharseko]

Fixes three Jackson vulnerabilities, all patched in the 2.18.8 release:

• GHSA-r7wm-3cxj-wff9 (jackson-core, CVSS 8.7) — maxNumberLength bypass when JSON is streamed in small chunks: up to ~20 MB of digits could accumulate before validation (memory-exhaustion DoS).
• CVE-2026-54512 (jackson-databind, CVSS 8.1) — PolymorphicTypeValidator bypass via generic type parameters: an allowed container type can wrap a denied nested type argument (RCE-capable PoC published).
• CVE-2026-54513 (jackson-databind, CVSS 8.1) — PTV bypass via allowIfSubTypeIsArray(): the array wrapper is allowed without validating the component type.

OpenDJ does not pin a Jackson version itself — the vulnerable 2.18.6 came from the imported org.openidentityplatform.commons:parent:3.1.2 BOM. This change adds a jackson.version property (2.18.9, the latest 2.18.x patch) and imports com.fasterxml.jackson:jackson-bom ahead of the commons parent BOM, so the fixed version wins (Maven honors the first BOM that manages an artifact).

Verification:

• mvn dependency:tree across the whole reactor: every Jackson artifact (jackson-core, jackson-databind, jackson-annotations, transitive jackson-module-jsonSchema) now resolves to 2.18.9.
• Tests of the Jackson-using modules pass: opendj-core (8182 tests), opendj-rest2ldap (531 tests), zero failures.

[vharseko]

Superseded by OpenIdentityPlatform/commons#307 — the Jackson upgrade to 2.18.9 belongs in the shared org.openidentityplatform.commons:parent BOM (which pins the version for all downstream projects), not as a per-project override. Once commons is released, OpenDJ picks up the fix via a commons.version bump.