spring-framework-6 update

Migration to sping-framework 6 is required by December 2024 to ensure we remain on a supported platform and have access to the latest security fixes.

Update: The deadline was [changed](https://spring.io/blog/2024/03/01/support-timeline-announcement-for-spring-framework-6-0-x-and-5-3-x) to **August 2024**.

This is a roadmap planning item.

UPDATE: This activity is being covered by GeoNetwork 5: https://github.com/orgs/geonetwork/projects/4

## Risk Assessment

### Spring Security (MEDIUM)

The spring-security framework requires updating, spring-security 5.8 has been provided as a migration target to that can be safely reached prior to migration to spring-framework 6.

### Jakarta Enterprise Edition (LOW)

This activity necessitates an update to Jakarta Enterprise Edition. GeoNetwork code may need to change a few imports such as Servlet, but spring-framework largely isolates our codebase from this change.

### Java 17 (MEDIUM)

This activity necessitates update to Java 17, which results in a number of dependencies needing to be updated or replaced:

* [Saxon --> Saxon HE](https://github.com/orgs/geonetwork/projects/2/views/1?pane=issue&itemId=55079122)
* (more will be discovered which is why this is a risk item)

The change to Java 17 starts to enforce more restrictions on dependencies making this entire activity difficult to establish scope.

## Why this is important

The spring-framework is the glue which holds the GeoNetwork application together and provides a lot of the security integrations we use with other systems. It is important to remain on a supported version of the spring-framework so we can maintain compatibility with newer versions of Java and Tomcat, and have access to fixes for security vulnerabilities.

The CVE vulnerabilities are already published, leading to interest in this activity.

## Proposal Support

Those with developer resources can contribute directly. For more information funding this activity look at commercial support options, or [GeoNetwork-2024-Sponsorship-Opportunities](https://github.com/geonetwork/core-geonetwork/wiki/GeoNetwork-2024-Sponsorship-Opportunities) to coordinate funding across several parties.

Start with the GeoNetwork 5 project linked in the issue, then review the Spring Security, Jakarta Enterprise Edition, Java 17, and Saxon dependency risks listed here. This issue does not name files, tests, or completion criteria; the migration scope and definition of done would need to be established in the linked project.

Written by the indexing model from the issue text.