Chore/remaining dependency updates (#920)

* fix(cdk): Pin jackson-databind to 2.21.4 to avoid GHSA-5jmj-h7xm-6q6v

jackson-databind 2.22.0 is affected by GHSA-5jmj-h7xm-6q6v (case-
insensitive deserialization bypasses per-property @JsonIgnoreProperties)
and no patched 2.22.x release exists yet. Downgrade to 2.21.4, the
highest release outside the vulnerable range.

* chore(dependabot): Exclude vendored META-INF pom from scans

The authorization server ships a vendored artifact pom under
META-INF/ that is dependency metadata, not a buildable module.
Exclude it from Maven scans so Dependabot stops opening noise PRs
against it.

---------

Co-authored-by: Yuriy Bezsonov <bezsonov@amazon.de>

Author: ybezsonov

.github/dependabot.yml

@@ -12,6 +12,10 @@ updates:
   - package-ecosystem: maven
     directories:
       - "**/*"
+      # Exclude the vendored artifact pom shipped inside the authorization
+      # server's META-INF/ (it is dependency metadata, not a buildable
+      # module) so Dependabot stops opening noise PRs against it.
+      - "!/samples/security/oauth/authorization-server/META-INF/**"
     schedule:
       interval: "monthly"
     open-pull-requests-limit: 15

infra/cdk/pom.xml

@@ -104,7 +104,10 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.22.0</version>
+            <!-- Pinned to 2.21.4: 2.22.0 is affected by GHSA-5jmj-h7xm-6q6v
+                 (case-insensitive deserialization bypasses per-property
+                 @JsonIgnoreProperties) with no patched 2.22.x release yet. -->
+            <version>2.21.4</version>
         </dependency>
 
         <!-- JSON library for policy parsing -->