Official Dependency-Track container image contains Java/JRE affected by CVE-2025-21587

### Current Behavior

The Dependency-Track container image contains Java/JRE files affected by CVE-2025-21587.

In our environment, the vulnerable Java/JRE files were detected inside the container filesystem / overlay storage. However, this Java installation does not appear to be used as the active runtime of the Dependency-Track application.

The application appears to run using a different Java runtime/version, while the vulnerable Java/JRE files remain present in the image/container filesystem.

As a result, vulnerability scanners report CVE-2025-21587 for the Dependency-Track container image even though the detected vulnerable Java installation is not used by the application at runtime.

### Steps to Reproduce

1. Deploy the Dependency-Track container image.
2. Scan the running container or host/container filesystem with a vulnerability scanner.
3. Observe that CVE-2025-21587 is reported for Java/JRE files inside the Dependency-Track container filesystem.
4. Verify the active Java runtime used by the application.
5. Observe that the vulnerable Java/JRE files appear to be present in the image but are not used as the active runtime.

### Expected Behavior

The Dependency-Track container image should not contain unused vulnerable Java/JRE installations or stale Java files.

If a Java/JRE installation is not required to run Dependency-Track, it should be removed from the final runtime image.

If Java is required, only the required patched runtime version should remain in the final image.

### Dependency-Track Version

4.x

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Start by inspecting the Dependency-Track 4.x container image, its filesystem contents, and the Java runtime actually used by the application. Compare the detected Java files with the active runtime and confirm that the final image contains only the required patched runtime, with CVE-2025-21587 no longer reported by a scanner.

Written by the indexing model from the issue text.