Bump java 8 and 11 versions

What does this MR do?

Bumps java 8 and 11 versions to something sdkman can use. Couple of interesting things happening in this MR. First, the versions of java 8 and 11 that are currently used in the Dockerfile are not available in sdkman's registry. So this bumps those versions to something sdkman can use. Next, the find security bugs plugin was not picking up multi module vulnerabilities so those have been added in the sast test report. Why weren't they being detected? Well, I'm still trying to figure out the root cause. But I suggest we not delay this fix.

What are the relevant issue numbers?

Does this MR meet the acceptance criteria?

• Changelog entry added
• Documentation created/updated for GitLab EE, if necessary
• Documentation created/updated for this project, if necessary
• Documentation reviewed by technical writer or follow-up review issue created
• Tests added for this feature/bug
• Job definition updated, if necessary
  • Auto-DevOps template (also in CE)
  • Job definition example
  • CI Templates (to be removed)
  • Vendored CI Templates (also in CE)
• Conforms to the code review guidelines
• Conforms to the Go guidelines
• Security reports checked/validated by reviewer