chore(deps): Spring Boot 3.5.16 고정 + 세션쿠키·로그 하드닝 + OWASP DC

- spring-boot 3.5.14-SNAPSHOT → 3.5.16(GA), spring-snapshots repo/pluginRepo 제거
- OWASP dependency-check-maven 12.2.2 plugin(executions 없음=빌드 phase 비bind)
- 세션쿠키: base http-only=true·same-site=lax / application-live.properties secure=true
- MyBatis 로그 TRACE→WARN(base), application-dev.properties 만 TRACE

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01K3FeMrbtxfTScjrwUukyHD

pom.xml

@@ -26,7 +26,7 @@
         <maven.compiler.release>${java.version}</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
-        <spring-boot.version>3.5.14-SNAPSHOT</spring-boot.version>
+        <spring-boot.version>3.5.16</spring-boot.version>
         <mybatis-spring-boot.version>3.0.5</mybatis-spring-boot.version>
         <lombok.version>1.18.44</lombok.version>
         <maven-clean-plugin.version>3.4.1</maven-clean-plugin.version>
@@ -205,28 +205,19 @@
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>12.2.2</version>
+                <configuration>
+                    <autoUpdate>false</autoUpdate>
+                    <failBuildOnCVSS>7</failBuildOnCVSS>
+                    <skipProvidedScope>true</skipProvidedScope>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
-    <repositories>
-        <repository>
-            <id>spring-snapshots</id>
-            <name>Spring Snapshots</name>
-            <url>https://repo.spring.io/snapshot</url>
-            <releases>
-                <enabled>false</enabled>
-            </releases>
-        </repository>
-    </repositories>
-    <pluginRepositories>
-        <pluginRepository>
-            <id>spring-snapshots</id>
-            <name>Spring Snapshots</name>
-            <url>https://repo.spring.io/snapshot</url>
-            <releases>
-                <enabled>false</enabled>
-            </releases>
-        </pluginRepository>
-    </pluginRepositories>
+
 
     <profiles>
         <profile>

src/main/resources/application-dev.properties

@@ -0,0 +1,3 @@
+# dev 전용 오버라이드 (spring.profiles.active=dev 시 자동 로드)
+# MyBatis SQL/파라미터 디버깅 — dev 한정
+logging.level.org.apache.ibatis=TRACE

src/main/resources/application-live.properties

@@ -0,0 +1,3 @@
+# live(운영) 전용 오버라이드 (spring.profiles.active=live 시 자동 로드)
+# HTTPS 운영 — 세션 쿠키 Secure 강제
+server.servlet.session.cookie.secure=true

src/main/resources/application.properties

@@ -25,6 +25,10 @@ app.webgl.frame-ancestors=self
 # upload storage (static 트리 밖 — 웹서버 직접 서빙 차단, 컨트롤러 권한게이트 경유)
 app.upload.game-storage-path=${user.home}/.bibimbap/uploads
 
+# session cookie hardening
+server.servlet.session.cookie.http-only=true
+server.servlet.session.cookie.same-site=lax
+
 # log
 mybatis.configuration.log-impl=org.apache.ibatis.logging.slf4j.Slf4jImpl
-logging.level.org.apache.ibatis=TRACE
+logging.level.org.apache.ibatis=WARN