**security** · pom · applications that get Jackson through Flow on this
branch

Updates the managed Jackson version from 2.22.3 to 2.22.4 to pick up the
fix for CVE-2026-110879
([GHSA-m8xf-2cr7-77ph](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-m8xf-2cr7-77ph)),
a PolymorphicTypeValidator bypass in jackson-databind. Flow itself does
not use class-name type ids or default typing, but applications that do
are exposed while the vulnerable version is managed.

**Risks:**
- ✅ Patch release in the same minor line; no API, behaviour,
serialization or migration impact expected.

- Updated `jackson.version` from 2.22.3 to 2.22.4.

Co-authored-by: totally-not-ai[bot] <290682512+totally-not-ai[bot]@users.noreply.github.com>