CVE-2022-25857/CVE-2022-38752: bump snake-yaml dependency to avoid versions with public CVEs

[k-wall]

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

[akatona84]

This version is only used in dependency management section of this pom and the dependency itself (org.yaml:snakeyaml) is not pulled in anywhere. So it is not bumped when you pull in swagger-parser libs, transitively still the 1.30 version coming.

org.example:untitled:jar:1.0-SNAPSHOT
\- io.swagger.parser.v3:swagger-parser:jar:2.1.3:compile
   +- io.swagger.parser.v3:swagger-parser-v2-converter:jar:2.1.3:compile
   |  +- io.swagger:swagger-core:jar:1.6.7:compile
   |  |  +- org.apache.commons:commons-lang3:jar:3.2.1:compile
   |  |  +- org.slf4j:slf4j-api:jar:1.7.22:compile
   |  |  +- io.swagger:swagger-models:jar:1.6.7:compile
   |  |  |  \- io.swagger:swagger-annotations:jar:1.6.7:compile
   |  |  +- com.google.guava:guava:jar:31.0.1-android:compile
   |  |  |  +- com.google.guava:failureaccess:jar:1.0.1:compile
   |  |  |  +- com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile
   |  |  |  +- com.google.code.findbugs:jsr305:jar:3.0.2:compile
   |  |  |  +- org.checkerframework:checker-qual:jar:3.12.0:compile
   |  |  |  +- org.checkerframework:checker-compat-qual:jar:2.5.5:compile
   |  |  |  +- com.google.errorprone:error_prone_annotations:jar:2.7.1:compile
   |  |  |  \- com.google.j2objc:j2objc-annotations:jar:1.3:compile
   |  |  \- javax.validation:validation-api:jar:1.1.0.Final:compile
   |  +- io.swagger:swagger-parser:jar:1.0.62:compile
   |  +- io.swagger:swagger-compat-spec-parser:jar:1.0.62:compile
   |  |  +- com.github.java-json-tools:json-schema-validator:jar:2.2.14:compile
   |  |  |  +- com.github.java-json-tools:jackson-coreutils-equivalence:jar:1.0:compile
   |  |  |  +- com.github.java-json-tools:json-schema-core:jar:1.2.14:compile
   |  |  |  |  +- com.github.java-json-tools:uri-template:jar:0.10:compile
   |  |  |  |  \- org.mozilla:rhino:jar:1.7.7.2:compile
   |  |  |  +- com.sun.mail:mailapi:jar:1.6.2:compile
   |  |  |  +- joda-time:joda-time:jar:2.10.5:compile
   |  |  |  +- com.googlecode.libphonenumber:libphonenumber:jar:8.11.1:compile
   |  |  |  \- net.sf.jopt-simple:jopt-simple:jar:5.0.4:compile
   |  |  +- com.github.java-json-tools:json-patch:jar:1.13:compile
   |  |  |  +- com.github.java-json-tools:msg-simple:jar:1.2:compile
   |  |  |  |  \- com.github.java-json-tools:btf:jar:1.3:compile
   |  |  |  \- com.github.java-json-tools:jackson-coreutils:jar:2.0:compile
   |  |  \- org.apache.httpcomponents:httpclient:jar:4.5.13:compile
   |  |     +- org.apache.httpcomponents:httpcore:jar:4.4.13:compile
   |  |     +- commons-logging:commons-logging:jar:1.2:compile
   |  |     \- commons-codec:commons-codec:jar:1.11:compile
   |  +- io.swagger.core.v3:swagger-models:jar:2.2.3:compile
   |  \- io.swagger.parser.v3:swagger-parser-core:jar:2.1.3:compile
   +- io.swagger.parser.v3:swagger-parser-v3:jar:2.1.3:compile
   |  +- io.swagger.core.v3:swagger-core:jar:2.2.3:compile
   |  |  +- jakarta.xml.bind:jakarta.xml.bind-api:jar:2.3.2:compile
   |  |  |  \- jakarta.activation:jakarta.activation-api:jar:1.2.1:compile
   |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.13.3:compile
   |  |  +- io.swagger.core.v3:swagger-annotations:jar:2.2.3:compile
   |  |  \- jakarta.validation:jakarta.validation-api:jar:2.0.2:compile
   |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.13.2:compile
   |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.13.2.2:compile
   |  |  \- com.fasterxml.jackson.core:jackson-core:jar:2.13.2:compile
   |  \- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.13.2:compile
   |     \- org.yaml:snakeyaml:jar:1.30:compile
   \- commons-io:commons-io:jar:2.11.0:compile

In order to truly override, you'd need to add it as direct dependency to modules where transitively is coming (and maybe excluding from the lib where it's coming from)