Pin jsoup and junrar in the Tika bundle

[jaymcnallie]

Tika 3.3.2 (latest) pulls jsoup 1.22.2 and junrar 7.6.0, which the ddf/thirdparty/tika bundle embeds:

CVE	Severity	Library	Fixed in
CVE-2026-75140	HIGH	jsoup 1.22.2	1.23.2
CVE-2026-71497	MEDIUM	jsoup 1.22.2	1.23.1
CVE-2026-86071	LOW	junrar 7.6.0	7.6.1

• thirdparty/tika/pom.xml: module-scoped dependencyManagement pinning jsoup to the existing ${jsoup.version} (1.23.2, already used by the simple search UI) and junrar to ${junrar.version}
• pom.xml: add junrar.version 7.6.1

Verified:

• dependency tree resolves jsoup 1.23.2 and junrar 7.6.1; bundle embeds them in place of the old jars; Import-Package unchanged
• Tika AutoDetectParser run on the bundle's embedded jars, old vs new: identical results for an HTML document and the itest RAR sample
• Trivy on the Tika bundle: 3 findings -> 0