Fix dependency CVEs: kafka-clients, react-router, serialize-javascript, fast-uri, brace-expansion

[lekhrocks]

Summary

Resolves five open dependency CVEs across the Java, UI, and website projects.

Changes

Java

• kafka-clients 3.9.0 → 3.9.2 — CVE-2025-27817 (SSRF/arbitrary file read, fixed 3.9.1). Also matches the version Debezium already requests.

UI

• react-router-dom → react-router v8 (8.3.0) — GHSA-qwww-vcr4-c8h2 (RSC mode CSRF bypass, fixed 8.3.0). react-router-dom has no v8 (merged into react-router), so switched the dependency and migrated all imports (react-router-dom → react-router). React 19.2.7 already meets v8's peer requirement.
• brace-expansion 1.1.16 → 1.1.18 — CVE-2026-69152 (transitive via minimatch).

Website

• serialize-javascript 6.0.2 → 7.0.7 — GHSA-5c6j-r48x-rmvq (fixed 7.0.3) via package.json overrides bumping copy-webpack-plugin to 14.0.0 and css-minimizer-webpack-plugin to 8.0.0 (latest, which require serialize-javascript ^7).
• fast-uri 3.1.3 → 3.1.5 — CVE-2026-18446, CVE-2026-16221.
• brace-expansion 1.1.16 → 1.1.18 — CVE-2026-69152.

Validation

• Full ./gradlew test passes
• UI: tsc --noEmit + vite build pass
• Website: docusaurus build passes

Notes

• The website override bumps the two webpack plugins, which re-resolves the tree (some transitive deps move to newer compatible versions). Build verified.
• Jetty CVE-2026-1605 and uuid CVE-2026-41907 remain as documented accepted risk (unfixable without breaking Debezium/webpack-dev-server; addressed in a separate follow-up).
• A follow-up will implement real token authentication and CSRF policy end-to-end (CSRF is currently disabled for the header-token API).