DatabaseConnection.xml - Password

Should be possible to script that has the password salted, no? Inject the password, start/restart the service, remove the password. Totally grasping at straws, but...

This is very common. Control access to your tomcat servers and lock down what IPs/hosts can use MySQL credentials.

There is no vault or secure DB credential storage for jamf (yet). Ideally, you would gate direct access to Tomcats behind some sort of appliance like HA Proxy, Nginx, a VIP/Load balancer, etc. Then require a VPN connection or other forms of auth/access control to your direct host that is serving Tomcat. Then in your MySQL grants, be very explicit on what hosts can access the DB like mentioned above.

This doesn't negate the fact that the credentials are stored in clear text, but it does add layers of access/security to the database itself.