I was able to override files in the camunda 7.9.0 webjar, simply by putting them into src/main/resources/META-INF/resources. In there I have app/tasklist/scripts/config.js and it overrides the one from the webjar.
From 7.10.0 the layout has changed, use src/main/resources/webjars/camunda/app. You can find out where spring-boot is searching for resources by debugging org.springframework.web.servlet.resource.PathResourceResolver#getResource(), look at the incoming locations.