Motivation for this change

According to this announcement:
http://mail-archives.us.apache.org/mod_mbox/www-announce/201906.mbox/%3Cca69531a-1592-be7b-60ce-729549c7f812%40apache.org%3E

.. both the 8.5 and 9 versions we have in nixpkgs are vulnerable. I ran the tomcat nixos test with services.tomcat.package set to tomcat85 and tomcat9. Both tests passed locally.

Not sure of the severity of the CVE. Perhaps this should be backported to 19.03 as well.

@GrahamcOfBorg build tomcat85 tomcat9

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Assured whether relevant documentation is up to date
• Fits CONTRIBUTING.md.