Bump Tomcat to version >= 9.0.86 and 10.1.19

[tasso94]

Acceptance Criteria (Required on creation)

Bump Tomcat to version >= 9.0.86 (all project) and 10.1.19 (spring-boot-starter, camunda-run).

Hints

Links

• https://jira.camunda.com/browse/SEC-1021.

Breakdown

### camunda-bpm-platform PR
- [ ] https://github.com/camunda/camunda-bpm-platform/pull/4442

### 7.21 Backport PR
7. [ ] https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1236

### 7.20 Backport PR
7. [ ] https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1237

### 7.19 Backport PR
7. [ ] https://github.com/camunda/camunda-bpm-platform-maintenance/pull/1238

Dev2QA handover

• [ ] Does this ticket need a QA test and the testing goals are not clear from the description? Add a Dev2QA handover comment

[psavidis]

Tomcat Versions Status Quo and Updates

• spring-boot-starter, camunda-run
  • ✔ 7.22-SNAPSHOT spring-boot-starter, camunda-run already support Tomcat 10.1.24 through the merged Spring Boot 3.3.0 feature
  • ✔ 7.21.3-SNAPSHOT - Same as the above
  • ✔ 7.20.7-SNAPSHOT- supports spring-boot:3.1.12 which brings transitively Tomcat 10.1.24
  • ❓ 7.19.14-SNAPSHOT - supports spring-boot:2.7.18 which brings transitively Tomcat 9.0.83, a distro not based on jakarta namespace.
    • Problem: In order to update the tomcat version used from spring-boot to a major higher than 9, spring-boot:3.x needs to be upgraded as well.
    • Solution Idea: Upgrade to latest Tomcat 9.0.89 for spring-boot-starter and camunda-run.
• Project Tomcat version
  • 7.22 and backports need to bump version.tomcat to a version greater than 9.0.86; Latest Tomcat 9 patch 9.0.89 is selected

[psavidis]

Update

The Solution Idea is verified. No need to Upgrade Spring Boot to benefit from a Tomcat 10 upgrade as this would imply a lot of effort.

[psavidis]

Assigning to @joaquinfelici for the Review.

[joaquinfelici]

Approved main PR and backports, assigning back to @psavidis .

[psavidis]

Merged Main and Backport PRs.

Closing the ticket.