Upgrade Jetty to 12.0.40

[vharseko]

Upgrades jetty.version from 12.0.32 to 12.0.40 (latest 12.0.x), which resolves the open Dependabot alerts on org.eclipse.jetty:jetty-server:

Alert	Severity	Advisory	Fixed in
#79	medium	GHSA-f4v5-65jj-pcr2 – cross-request leakage of trailers on HTTP/1.1 keep-alive connections	12.0.36
#78	medium	GHSA-7p3p-8qv8-m2vh – HTTP/2 and HTTP/3 accept a Host header that differs from :authority	12.0.35

#79 applies to OpenIDM because it serves HTTP/1.1. #78 is not exploitable in the default setup: conf/jetty.xml defines only HTTP/1.1 and TLS connectors, and HTTP/2 is not enabled. The upgrade stays on the 12.0.x line, which matches the org.eclipse.jetty.*;version="[12.0,…)" imports of pax-web-jetty 11.0.0.

Note: jetty-xml is not managed by jetty.version and still comes in as 12.0.22 through Pax Web. It was already out of step before this change (12.0.32 vs 12.0.22), and none of the advisories above affect it.

Testing (JDK 17, macOS)

• mvn verify: BUILD SUCCESS.
• The openidm-zip distribution bundles jetty-{server,http,io,util,security,session,ee10-servlet,ee10-servlets}-12.0.40.jar.
• The unpacked distribution starts and logs OpenIDM ready, with no ERROR|SEVERE|Exception|Throwable lines in openidm0.log.0.
• GET /openidm/info/ping returns 200 {"state":"ACTIVE_READY"}.