[STAC-25424] Extend Jetty CVE-2024-6763 VEX to 9.4.63.sts1

[LouisLotter]

Summary

• extend the existing CVE-2024-6763 statement to the exact product pkg:maven/org.eclipse.jetty/jetty-http@9.4.63.sts1
• replace an unverifiable commit reference in the older statement with evidence from commits that are present in the fork and ancestors of both covered releases
• regenerate index.json

Jira: https://stackstate.atlassian.net/browse/STAC-25424

Evidence

• jetty-9.4.63.sts1 is a valid signed tag resolving to 7bafbcf1a588fbd3a8b393bdad32ff88f6076b00
• db8bb7a8631 (Fix CVE-2024-6763 (#12532)) is an ancestor of both covered tags and adds USER_INFO tracking, strict authority/percent-encoding validation, and bad-authority regression tests
• 89d2ac7c779 (Regular handling of bad URIs (#14011)) is an ancestor of both covered tags and adds follow-up authority-confusion regression tests
• current StackVista/docker-images main pins JETTY_VERSION=9.4.63.sts1, fetches jetty-http, and replaces the Hadoop-distributed jar with that exact artifact
• the assertion remains exact-version scoped; it does not cover future StackVista Jetty builds

Validation

• python3 -m json.tool pkg/maven/org.eclipse.jetty/jetty-http/scan.openvex.json
• python3 tools/build_index.py --check
• scanned quay.io/stackstate/hadoop:3.5.0-so10 with Trivy 0.70.0 and current vulnerability/Java databases
• scanned the same image with Grype 0.112.0 and database built 2026-07-27

Scanner	No VEX	Proposed exact VEX	Mismatched 9.4.60.sts1-only VEX
Trivy CVE-2024-6763 findings	2	0	2
Grype GHSA-qh8g-58pp-2wxh findings	2	0	2

The two findings are the copies of jetty-http-9.4.63.sts1.jar in Hadoop common and HDFS. The negative test confirms that both scanners suppress only the exact 9.4.63.sts1 product.

The corresponding Rancher VEX Hub submission is intentionally deferred until this internal statement has been reviewed and merged.