Merge "[POLICY] tomcat security upgrade legacy components" into frankfurt