security: update Jackson and logging coverage

[kevinten10]

Summary

• update Jackson Databind and related Jackson modules to 2.18.9, closing the current medium-severity advisory
• document the Java 8 and Logback 1.3.x end-of-life boundary in English and Chinese
• extend CI to verify Java 8 and Java 11 compatibility plus Java 11 with Logback 1.5.38

Verification

• full Maven verify on Java 8 with default Logback 1.3.16
• full Maven verify on a modern JDK with Logback 1.5.38
• dependency tree resolves Jackson Databind, Core, and Annotations 2.18.9
• actionlint passes
• README links pass

Compatibility

Java 8 remains supported without forcing a Java 11-only Logback release. The actively maintained Logback path is documented and covered by CI.