Authzforce GE docker image is vulnerable

[kirgahn]

As per subject of this issue, the current Authzforce GE docker image is vulnerable (for eg. see CVE-2022-29885) due to its dependence on the base tomcat:9-jre11-slim docker image which hasn't been updated in three years and is currently unmaintained.

Unfortunately, simply building the image from another up-to-date official image doesn't work. For example, here's an log excerpt of Authzforce failing when running an image built from tomcat:9-jdk11:

2022-06-09 09:51:36,866|ERROR|main|org.springframework.web.context.ContextLoader:313|Context initialization failed|
org.springframework.beans.factory.BeanDefinitionStoreException: Unexpected exception parsing XML document from ServletContext resource [/WEB-INF/beans.xml]; nested exception is org.springframework.beans.FatalBeanException: Unresolvable class definition for NamespaceHandler class [org.apache.cxf.bus.spring.NamespaceHandler] for namespace [http://cxf.apache.org/core]; nested exception is java.lang.NoClassDefFoundError: javax/xml/ws/WebServiceFeature

I've tested several different base images, both JRE and OpenJDK based, with no success.
This GE is currently deployed on VMs hosted on FIWARE nodes and should be maintained on an updated base image for security reasons.

[cdanger]

Yes, it is about time we switch to the latest official Docker images for tomcat 9, such as this one:
https://hub.docker.com/layers/tomcat/library/tomcat/9-jre11-temurin-focal/images/sha256-561eaf1795a547db766341ce94073c274f8ea5f72d4b3b042c87e6c2d4bc4a69

[cdanger]

I have published a new version of Authzforce docker image based on the tomcat9 image above:
https://hub.docker.com/layers/fiware/authzforce-ce-server/release-11.0.1/images/sha256-90fc535ced1bcc5cc04254621acead179e6dedd5afe72077322e281dc5dffedd?context=repo