fix(cdk): Pin jackson-databind to 2.21.4 to avoid GHSA-5jmj-h7xm-6q6v

jackson-databind 2.22.0 is affected by GHSA-5jmj-h7xm-6q6v (case-
insensitive deserialization bypasses per-property @JsonIgnoreProperties)
and no patched 2.22.x release exists yet. Downgrade to 2.21.4, the
highest release outside the vulnerable range.

Author: Yuriy Bezsonov

infra/cdk/pom.xml

@@ -104,7 +104,10 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.22.0</version>
+            <!-- Pinned to 2.21.4: 2.22.0 is affected by GHSA-5jmj-h7xm-6q6v
+                 (case-insensitive deserialization bypasses per-property
+                 @JsonIgnoreProperties) with no patched 2.22.x release yet. -->
+            <version>2.21.4</version>
         </dependency>
 
         <!-- JSON library for policy parsing -->