FEC-3922: suppress stack trace and server info in Tomcat error responses

Add ErrorReportValve with showReport="false" showServerInfo="false" to
the Host block in server.xml. Addresses CISA BOD 18-01 finding for
externally-facing Tomcat sites that lack an httpd reverse proxy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: dgoodellrhy

templates/catalina_base.conf.server.xml.j2

@@ -48,6 +48,8 @@
 {% if tomcat_rewrite_rules|length > 0 %}
         <Valve className="org.apache.catalina.valves.rewrite.RewriteValve" />
 {% endif %}
+        <Valve className="org.apache.catalina.valves.ErrorReportValve"
+               showReport="false" showServerInfo="false" />
         <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                prefix="localhost_access_log" suffix=".txt"
                pattern="%h %l %u %t &quot;%r&quot; %s %b" />