fix(#712): upgrade Apache CXF to 4.1.7 (CVE-2026-44417) (#723)

Bump the bundled Apache CXF from 4.1.5 to 4.1.7 to remediate
CVE-2026-44417 (incomplete fix of CVE-2025-48913, remote code
execution via JMS configuration), which is fixed upstream in CXF
4.1.6 / 4.2.1 / 3.6.11. 4.1.7 is the latest 4.1.x patch and stays
within the existing OSGi import range [4.1,4.2).

The cxf-codegen-plugin version is moved in lockstep. The
camel-cxf-all bundle shades all org.apache.cxf:* artifacts via
${cxf-version}, so the rebuilt bundle embeds and re-exports CXF
4.1.7.

Author: jbonofre

pom.xml

@@ -166,8 +166,8 @@
         <consul-client-version>1.9.2</consul-client-version>
         <couchbase-client-version>3.11.0</couchbase-client-version>
         <curator-version>5.9.0</curator-version>
-        <cxf-version>4.1.5</cxf-version>
-        <cxf-codegen-plugin-version>4.1.5</cxf-codegen-plugin-version>
+        <cxf-version>4.1.7</cxf-version>
+        <cxf-codegen-plugin-version>4.1.7</cxf-codegen-plugin-version>
         <cxf-xjc-plugin-version>4.1.2</cxf-xjc-plugin-version>
         <cxf-xjc-utils-version>4.1.2</cxf-xjc-utils-version>
         <daffodil-version>3.10.0</daffodil-version>