fix: spring-core tomcat netty version bump

Derek Zhangrequested to merge
cve-fix into master

io.netty:netty-codec-http2 │ CVE-2025-55163

org.apache.tomcat.embed:tomcat-embed-core │ CVE-2025-48989

org.springframework:spring-core │ CVE-2025-41249

Merge request reports