json-schema-validator 3.x migration (CVE-2026-54512, CVE-2026-54513) #94

Dependabot PR #89 bumps com.networknt:json-schema-validator 1.4.3 → 3.0.7 to pull in a jackson upgrade that fixes CVE-2026-54512 and CVE-2026-54513. The PR itself doesn't build as a plain version bump: ValidationMessage was moved/renamed in the 3.x line, breaking the compile in SchemaValidator.java (lines 44, 47).

Needs a real code change, not just a dependency bump:

• Update the ValidationMessage usages in SchemaValidator.java to the 3.x API.
• Confirm the rest of the schema-validation call sites still compile against 3.0.7.
• Re-point PR deps: bump com.networknt:json-schema-validator from 1.4.3 to 3.0.7 #89 (or close it and land the migration + bump together).

Tracked separately from the routine dependabot batch since this one carries an actual CVE and can't be merged as-is.