Feature/1004 update javalin drop tomcat

[MikeNeilson]

Summary

Move to latest javalin (7.2.3)

Remove Use of Tomcat, no Tomcat 11+ in our local environment so will just use Javalin's default jetty and package it up.

NOTE: Due to Javalin updating the annotation plugin (this happened in javalin 5) this is going to be a large change as it touches every file and will need to alter how the OpenAPI static test works.

Related Issue

Validation

Existing integration tests

Checklist

• AI tools used

[MikeNeilson]

NOTE: at best I will have the annotations updated today. Getting the API running again in it's standalone mode will likely take until the end of the week if not longer.

[MikeNeilson]

For the record. I have considered keeping with tomcat and just using like embedded tomcat for the packaging, but Javalin was made for Jetty so since that would be a fair amount of work anyway, better to use a tool that was actually built for this given style of packaging an app.

[MikeNeilson]

FYI, I am aware this PR is rather huge.

The OpenAPI changes basically have to be all or nothing. I think we can all agree on that.

It also requires the migration to Jakarta EE (javalin update) which would may or may not (java.security.Principal so probably not) affect the CwmsAaaIdentityProvider.

So fair amount of changes to Tomcat anyway.

So is this likely to be a pain... yes, but I'm arguing it's worth it.

I could pivot back and do the move to standalone Javalin (e.g. Jetty whatever version that was) first, but then without updating javalin frankly it wouldn't be in a releasable state (security concerns, that's a really old Jetty)

So. for now I'm going to barrel through. I'm open to addressing concerns and pivoting if they're strong enough.

We do have a lot of plans. and the bulk are passing. What's failing is most likely various validation I've intentionally disabled due to the location of initialization changing.