Bump Jackson to 2.22.1 (CVE-2026-54515)

- fix(deps): jackson-bom 2.22.1 closes the last open Jackson advisory
  (CVE-2026-54515), now published on Maven Central. Clears the final
  Dependabot alert; full unit suite green (448 tests).