feat(version): answer the build commit and time

GET /api/version is public. CI passes GIT_SHA and BUILD_TIME as Docker build args; a local build answers dev.

src/main/resources/application.yml

@@ -45,6 +45,10 @@ security:
 
 # Custom properties for CORS
 app:
+  build:
+    # Filled from the CI run by the Dockerfile.
+    commit: ${APP_BUILD_COMMIT:dev}
+    time: ${APP_BUILD_TIME:}
   cors:
     # Production default: strictly allow only the frontend domain
     allowed-origins: "https://tbp.andreas-dahm.eu"