fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat 10.1.57, clears CVE-2026-59083/59084)

aria's cd-develop OWASP gate was failing on tomcat-embed-core 10.1.56:
CVE-2026-59083 (9.1) and CVE-2026-59084 (9.1). bom 1.0.9 pins tomcat 10.1.57
(+ Spring Boot 3.5.16), which clears both — verified by reproducing the OWASP
scan on the CI runner against /opt/owasp-data (exit 0, BUILD SUCCESS). Pipeline
had been red fleet-wide since 2026-07-16; unrelated to the ingest-filter change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pom.xml

@@ -14,7 +14,7 @@
     <parent>
         <groupId>com.hiveops</groupId>
         <artifactId>hiveops-bom</artifactId>
-        <version>1.0.8</version>
+        <version>1.0.9</version>
         <relativePath/>
     </parent>