jackson-databind 2.12.6 is still vulnerable and should be bumped

[lmr3796]

While #1670 bumps it to 2.12.6 for a fix, but it turns out to be insufficient and we need a recently released 2.12.6.1+ or 2.13.2.2+

See FasterXML/jackson-databind#2816 for details.