strimzi-kafka-operator/0.49.1-r2: fix GHSA-3677-xxcr-wjqv

<!--ci-cve-scan:must-fix: GHSA-3677-xxcr-wjqv-->

Author: octo-sts[bot]

strimzi-kafka-operator.yaml

@@ -1,7 +1,7 @@
 package:
   name: strimzi-kafka-operator
   version: "0.49.1"
-  epoch: 2 # GHSA-vc5p-v9hr-52mj
+  epoch: 3 # GHSA-3677-xxcr-wjqv
   description: Apache Kafka® running on Kubernetes
   copyright:
     - license: Apache-2.0

strimzi-kafka-operator/pombump-deps.yaml

@@ -8,3 +8,6 @@ patches:
   - groupId: org.apache.logging.log4j
     artifactId: log4j-core
     version: 2.25.3
+  - groupId: org.bitbucket.b_c
+    artifactId: jose4j
+    version: 0.9.6