Find CVE-2026-22732 (Spring Security header suppression)

Detects code susceptible to CVE-2026-22732, where setting Content-Length via HttpServletResponse.setHeader / setIntHeader / addIntHeader (or the WebFlux equivalents) bypasses Spring Security's OnCommittedResponseWrapper, letting the container commit the response before the lazy header-writing filter runs and silently dropping security headers (X-Frame-Options, X-Content-Type-Options, Cache-Control, etc.). Projects that resolve a fixed version, and projects already writing headers eagerly -- whether by hand, by vendoring a patched wrapper, or by carrying the configuration the fix recipe generates -- are not reported. Also emits one data-table row per project recording the resolved Spring Security version.