chore: [DevOps] bump the production-minor-patch group with 2 updates

[dependabot]

Bumps the production-minor-patch group with 2 updates: io.swagger.core.v3:swagger-models and com.sap.cloud.security:java-bom.

Updates io.swagger.core.v3:swagger-models from 2.2.51 to 2.2.52

Updates com.sap.cloud.security:java-bom from 4.0.6 to 4.0.7

Release notes

Sourced from com.sap.cloud.security:java-bom's releases.

4.0.7

• Fix multi-tenant XSUAA token exchange in DefaultXsuaaTokenExtension
  • The IAS-to-XSUAA exchange used the provider subdomain endpoint, which caused XSUAA to resolve the provider tenant instead of the tenant carried in the X-zid header (app_tid)
  • Token exchange now targets a tenant-agnostic endpoint built from the uaadomain binding property, so XSUAA resolves the tenant via X-zid
  • For X.509 credentials the host's authentication. segment is replaced with authentication.cert. (analogous to the Node.js library), e.g. authentication.eu10.hana.ondemand.com → authentication.cert.eu10.hana.ondemand.com
  • Falls back to the existing subdomain-bearing endpoint when uaadomain is missing, preserving behavior for legacy bindings

Changelog

Sourced from com.sap.cloud.security:java-bom's changelog.

4.0.7

• Fix mTLS handshake regression in SSLContextFactory
  • Initialize the SSLContext with an explicit TrustManagerFactory backed by the system default trust store instead of passing null, fixing (certificate_unknown) No X509TrustManager implementation available failures observed on certain runtime configurations
• Add missing no-arg constructor to DefaultOAuth2TokenService
  • The class lacked the no-arg constructor that the migration documentation (token-client/CUSTOM_HTTPCLIENT.md) advertised
  • The sibling services DefaultOAuth2TokenKeyService and DefaultOidcConfigurationService already had it; this restores symmetry
  • The new constructor obtains a SecurityHttpClient via SecurityHttpClientProvider.createClient(null) and delegates to the existing (SecurityHttpClient) constructor
• Fix multi-tenant XSUAA token exchange in DefaultXsuaaTokenExtension
  • The IAS-to-XSUAA exchange used the provider subdomain endpoint, which caused XSUAA to resolve the provider tenant instead of the tenant carried in the X-zid header (app_tid)
  • Token exchange now targets a tenant-agnostic endpoint built from the uaadomain binding property, so XSUAA resolves the tenant via X-zid
  • For X.509 credentials the host's authentication. segment is replaced with authentication.cert. (analogous to the Node.js library), e.g. authentication.eu10.hana.ondemand.com → authentication.cert.eu10.hana.ondemand.com
  • Falls back to the existing subdomain-bearing endpoint when uaadomain is missing, preserving behavior for legacy bindings

Commits

• fb4e8bf chore: Release 4.0.7
• 66177c8 fix: Replace authentication. with authentication.cert. for X.509 uaadomain
• 843ba02 fix: Use tenant-agnostic XSUAA token endpoint when exchanging IAS to XSUAA
• 3ac8356 Merge pull request #1966 from SAP/chore/remove-nvd-api-key
• 2461312 chore: Remove unused NVD_API_KEY secret from CI workflow
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions