Update Veracode dependencies and python3 base image

[breedenc]

Description

• Veracode Dockerfile:

  • Updated Veracode dependencies
  • For packages sourced from package managers, pinned them to minor versions, rather than specific patches
  • Pinned base images to major.minor versions, rather than specific SHAs, to accept patch-level updates
  • Sources maven from a https://repo.maven.apache.org, which keeps previous versions available (unlike https://downloads.apache.org)

• python3 Dockerfile:

  • Pinned base image to minor version python3.11, rather than major version python3

Motivation and Context

Veracode image

The Veracode container image was failing to build because some of its highly specific package versions were no longer available to apt-get, and because its specified version of Maven was no longer available at https://downloads.apache.org. This PR undoes some of the work from #62 in the interest of automatically accepting patch-level updates, reducing the frequency of required image maintenance.

python3 image

When the python3 image shifted to Python 3.12, the image would no longer build due to: aio-libs/aiohttp#7739

How Has This Been Tested?

• Images now build successfully locally and in CI
• Change has been tested in a live nonprod environment to ensure continued scan functionality for plugins whose runtime environment was updated

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist

• My code follows conforms to the coding standards.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

Pic

[g-marconet]

Do we have some mechanism to come back to this?

If we don't have something outside the repo, maybe we can comment the reason that's in the description. Someone in the future might not look at this PR and, just looking at the code, the reason it's pinned to 3.11 is not obvious.

[breedenc]

Fair, I'll add a comment

[g-marconet]

LGTM