chore: suppress false positives for CVE-2026-22740 and CVE-2026-22741 after review

Author: chadlwilson

build-platform/dependency-check-suppress.xml

@@ -80,11 +80,20 @@
   </suppress>
   <suppress>
     <notes><![CDATA[
-    According to https://spring.io/security/cve-2026-22745 this issue only affects serving of static resources via spring-web/webflux
-    on Windows platforms. GoCD does not server static assets from the filesystem via Spring Web resource handler mechanisms (it uses
-    Jetty for static assets alongside custom handlers for artifact downloading.
+    According to https://spring.io/security/cve-2026-22740 this only affects webflux applications, which GoCD is not.
     ]]></notes>
     <packageUrl regex="true">^pkg:maven/org\.springframework/spring-.*@4\.3.*$</packageUrl>
+    <cve>CVE-2026-22740</cve>
+  </suppress>
+  <suppress>
+    <notes><![CDATA[
+    According to https://spring.io/security/cve-2026-22741 and https://spring.io/security/cve-2026-22745 these issues
+    only affects serving of static resources via spring-web/webflux. GoCD does not server static assets from the
+    filesystem via Spring Web resource handler mechanisms (it uses Jetty for static assets alongside custom handlers for
+    artifact downloading.
+    ]]></notes>
+    <packageUrl regex="true">^pkg:maven/org\.springframework/spring-.*@4\.3.*$</packageUrl>
+    <cve>CVE-2026-22741</cve>
     <cve>CVE-2026-22745</cve>
   </suppress>
   <suppress>