Upgrade json-smart from 2.5.1 to 2.5.2 fixing CVE-2024-57699

[julianladisch]

For details about CVE-2024-57699 see
https://github.com/netplex/json-smart-v2/releases/tag/2.5.2

Karate uses new JsonSmartJsonProvider() that uses JSONParser.MODE_PERMISSIVE that includes LIMIT_JSON_DEPTH and therefore is not affected by CVE-2024-57699:

• https://github.com/karatelabs/karate/blob/v1.5.2.RC2/karate-core/src/main/java/com/intuit/karate/JsonUtils.java#L74
• https://github.com/json-path/JsonPath/blob/json-path-2.9.0/json-path/src/main/java/com/jayway/jsonpath/spi/json/JsonSmartJsonProvider.java#L39
• https://github.com/netplex/json-smart-v2/blob/2.5.1/json-smart/src/main/java/net/minidev/json/parser/JSONParser.java#L110

However, other projects that use Karate may directly call new JsonSmartJsonProvider(int parseMode) with one of the other default modes and are vulnerable.

Therefore Karate should ship the fixed version.