fix(deps): upgrade Bouncy Castle past CVE-2025-14813 (critical) and CVE-2026-5598

The application-server image carried org.bouncycastle:bcprov-jdk18on 1.82, which
the build-time image scan rejects for CVE-2025-14813 (critical) and CVE-2026-5598,
both fixed in 1.84.

Bouncy Castle is transitive and unmanaged: com.github.docker-java:docker-java-core
-> bcpkix-jdk18on -> bcutil-jdk18on -> bcprov-jdk18on, and the Spring Boot BOM
manages no org.bouncycastle artifact, so docker-java's floor decided the version.
Manage the matched provider, util and PKIX set at 1.84 in the application POM so
Renovate keeps it current.

docker-java's TLS path is the only consumer, and it links against PEMParser,
JcaPEMKeyConverter, JcaX509CertificateConverter and BouncyCastleProvider, all
unchanged in 1.84; no Hephaestus code references Bouncy Castle at all.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/patched-server-image-crypto-library.md

@@ -0,0 +1,5 @@
+---
+"hephaestus": patch
+---
+
+The server image no longer ships a cryptography library with a known critical vulnerability, so it passes a high- and critical-severity image scan with nothing left to disposition. Deployments that talk to a TLS-protected Docker daemon keep working unchanged.

server/application/pom.xml

@@ -62,6 +62,12 @@
         <nullaway.version>0.14.0</nullaway.version>
         <shedlock.version>7.9.0</shedlock.version>
         <bucket4j.version>8.19.0</bucket4j.version>
+        <!-- Transitive only, via docker-java-core: bcpkix -> bcutil -> bcprov. Not managed by the
+             Spring Boot BOM, so the version it resolves to is docker-java's, and 1.82 carries
+             CVE-2025-14813 (critical) and CVE-2026-5598, both fixed in 1.84. Managed here so the
+             image scan stays clean and Renovate keeps it current; drop it once docker-java ships a
+             fixed floor of its own. -->
+        <bouncycastle.version>1.84</bouncycastle.version>
         <maven.build.cache.skipCache>true</maven.build.cache.skipCache>
         <maven.build.cache.skipSave>true</maven.build.cache.skipSave>
     </properties>
@@ -403,6 +409,25 @@
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
+            <!-- All three move together: Bouncy Castle only supports a matched provider, util and
+                 PKIX set. docker-java's TLS path (CertificateUtils, LocalDirectorySSLConfig) is the
+                 only consumer, and it links against PEMParser, JcaPEMKeyConverter,
+                 JcaX509CertificateConverter and BouncyCastleProvider, all unchanged in 1.84. -->
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcprov-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcutil-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.bouncycastle</groupId>
+                <artifactId>bcpkix-jdk18on</artifactId>
+                <version>${bouncycastle.version}</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <build>