super-connector: bump jackson-databind to 2.22.1 and netty to 4.1.136.Final (HIGH CVEs)

## Description

Remediates two **HIGH** Trivy findings in `pro/dc-agents/super-connector` for the v2.50 LTS line by bumping the affected dependency versions. No functional/behavioural change — dependency version overrides only.

| Library | Before | After | CVE(s) |
|---|---|---|---|
| `com.fasterxml.jackson.core:jackson-databind` | 2.21.2 | **2.21.4** | CVE-2026-54512, CVE-2026-54513 |
| `io.netty:netty-codec-stomp` (all `io.netty:*`) | 4.1.135.Final | **4.1.136.Final** | CVE-2026-44891 |

### How this was fixed (in `app/build.gradle.kts`)

- **jackson-databind**: The Quarkus BOM shipped `jackson-databind:2.21.2`. Added a `jackson-databind` version constraint at `2.21.4` and aligned the pre-existing `jackson-core` constraint (`2.21.1` → `2.21.4`) so the `jackson.core` group stays on one line. `jackson-annotations` is intentionally left unpinned — since Jackson 2.20 it dropped the patch component (there is no `2.21.4`), so `databind:2.21.4` pulls the correct `annotations:2.21` transitively via `jackson-bom`.
- **netty**: Bumped the single `ProjectVersions.netty` constant `4.1.135.Final` → `4.1.136.Final`. That constant drives the `netty-bom` platform, the `io.netty:*` `resolutionStrategy` force, and `netty-all`, so every Netty artifact (including `netty-codec-stomp`) stays aligned at `4.1.136.Final` — no mixed Netty versions.

Both bumps stay within the same minor line (minimal blast radius). No BOM/parent upgrade was required, so there are no broad transitive changes.

### How this was verified

Using JDK 21 + the project's Gradle wrapper:

- `./gradlew :app:compileKotlin :gdc-ir:compileKotlin :sql-gen:compileKotlin stripBundledNettyFromAthena` → **BUILD SUCCESSFUL** (only pre-existing warnings).
- `./gradlew :app:dependencyInsight`/`:app:dependencies --configuration runtimeClasspath` confirms the runtime classpath resolves:
  - `jackson-databind` → **2.21.4** (every requested older version resolves up)
  - `jackson-core` → **2.21.4**, `jackson-annotations` → **2.21**
  - every `io.netty:*` module (incl. `netty-codec-stomp`) → **4.1.136.Final**
  - no `jackson-databind:2.21.2` or `netty-codec-stomp:4.1.135.Final` survives resolution.

Module tests were **not** run: the super-connector test suite is `@QuarkusTest`/Testcontainers-based and requires Docker + live JDBC targets not available in this environment. The change is a version-only override validated via dependency resolution + compilation.

## Changelog

### Component
- [x] data-connector

### Product
- [x] enterprise-edition

### Type
- [x] security-fix

### Changelog entry

Bump `jackson-databind` (2.21.4) and Netty (4.1.136.Final) in the super-connector data connector to remediate HIGH severity CVEs (CVE-2026-54512, CVE-2026-54513, CVE-2026-44891).

PR-URL: https://github.com/hasura/graphql-engine-mono/pull/11628
Co-authored-by: Toan Nguyen  <1615675+hgiasac@users.noreply.github.com>
GitOrigin-RevId: 75859d46570fd24bde5f592a2dacf38c46342d18