fix: update Jackson and publish cache runtime 5.7.5

[chen21019]

Candidate scope

• Update the true parent Jackson 2 and Jackson 3 BOM properties to 2.22.3 and 3.2.3, respectively. FasterXML lists CVE-2026-91776 and CVE-2026-91777 fixes in both patch releases.
• Require the four embedded Jackson core/databind Maven metadata entries to report those exact patched versions.
• Align reactor/test fixtures, artifact carrier paths, SBOM identity and release gates with numeric artifact 5.7.5. Preserve Hazelcast cluster protocol/runtime 5.7.3, business logic and all other dependency pins.
• Check out the exact PR head and retain the successful reviewed JAR with its evidence using the existing artifact retention mechanism. Retention is not publication.
• Add the existing JsonUtilTest and JsonUtilImplTest suites to the same Maven invocation and mandatory Surefire report validator; retain the existing test floor and zero failures/errors/skips.

Local validation

Nine offline focused cases passed in separate executions: the original seven Jackson pin/packaged metadata/coordinate fixture cases, then one checkout-and-retention contract case, then one JSON selector-and-required-report contract case. Source preflight, shell syntax and git diff checks passed. No Maven/JAR/image build was executed locally.

Pending release evidence

This is an unbuilt source candidate, not a claim that vulnerabilities are fully fixed in a built or downstream artifact. The required PR test-build-scan and CodeQL checks, actual shaded JAR metadata, resolved Maven/SBOM evidence and current artifact vulnerability scan remain pending. Existing public v5.7.4 artifacts remain immutable. No tag, publication, downstream digest or deployment has been created by this change.