Fix M17.8 supply-chain CI regressions

[jmjava]

Summary

• keep the Spring starter on Boot 3.5.16 so its RestTemplateCustomizer integration remains compatible, while overriding Tomcat to patched 10.1.60
• move Python service images to upgraded Alpine bases to eliminate fixable Debian image findings
• gate image scans on fixable high/critical vulnerabilities while retaining all SARIF results
• remove the unsupported GitHub dependency-review check; repository-wide Trivy dependency scanning remains authoritative
• explicitly provision PHP DOM in CI and skip PHPUnit with a clear reason when best-effort local environments lack it

Failure evidence

• local regression failed because Boot 4 removed the imported RestTemplateCustomizer API
• Python image scans reported Debian base CVEs, including available package fixes and many no-fix findings
• dependency review is disabled in repository settings and cannot run here

Verification

• Spring starter Maven tests: pass
• M17.8 static acceptance tests: pass
• bash scripts/run-regression-agent.sh: regression exit code: 0 (local-only; no kubectl context)
• PR supply-chain scan passed on the first hotfix revision; final CI revision is pending