[GHSA-hcjr-322h-429r] Improper Handling of URL Encoding (Hex Encoding)... - #8960

Thanks for this PR. Based on the fix commits and the binary artifacts published to Maven Central, I'd suggest the following changes.

Correct the affected Maven packages and add patched versions.

• Remove the 8.5.x entries. The issue is the URLDecoder.decode() call on the rewritten URI in RewriteValve, which the fix replaces with UDecoder.URLDecode(). That call does not exist in 8.5.x (checked up to 8.5.100). It was introduced by "Better handling of URLs with literal ';' and '?'" (9.0.x: apache/tomcat@ee3ab54 , first in 9.0.103; 10.1.x: apache/tomcat@066bf6b , first in 10.1.40; 11.0.x: apache/tomcat@fbecc91 , first in 11.0.6).
• Lower bounds of the remaining entries follow the Apache advisory (11.0.0-M1 / 10.1.0-M1 / 9.0.0.M1). Note that releases before 9.0.103 / 10.1.40 / 11.0.6 do not contain this code path.
• Add org.apache.tomcat:tomcat (binary distribution), which ships RewriteValve.
• Add patched versions 11.0.24 / 10.1.57 / 9.0.120 (the entries in this PR only have an upper bound).

Suggested affected products:

Evidence:

• Apache Tomcat security pages: https://tomcat.apache.org/security-11.html , https://tomcat.apache.org/security-10.html , https://tomcat.apache.org/security-9.html
• Fix commits:
  • 11.0.x: apache/tomcat@f00ab28 (first included in 11.0.24)
  • 10.1.x: apache/tomcat@04e9ec3 (first included in 10.1.57)
  • 9.0.x: apache/tomcat@a520aec (first included in 9.0.120)