Security patch: override Jackson to 2.22.0

Clears jackson-databind CVE-2026-23183, CVE-2026-54512, CVE-2026-54513 and
CVE-2026-54515 (Spring Boot 3.5.14 manages the affected 2.21.2).