CAMEL-24503: camel-spring-boot - see camel properties supplied as environment variables

[oscerd]

CamelSecurityPolicyAutoConfiguration.extractCamelProperties() collects the properties the camel.security
policy framework (CAMEL-23250) evaluates, filtering on the name exactly as the source reports it:

if (name != null && name.startsWith("camel.") && !name.startsWith("camel.security.")) {

Property sources report names in their own form. An option set in application.properties arrives as
camel.component.http.trustAllCertificates; the same option set as an environment variable arrives as
CAMEL_COMPONENT_HTTP_TRUSTALLCERTIFICATES, which never matches the camel. prefix — even though Spring's
relaxed binding applies it to the component just the same.

So every Camel option configured through the environment escaped the policy check. That is the usual way to
configure a containerised application, so the check was blind to a large part of real deployments.

Change

Names are canonicalized with Spring Boot's own ConfigurationPropertyName.adapt(name, '_') before the prefix
test, and the canonical name is used for the value lookup so relaxed binding resolves it back to the variable.

This works end to end because SecurityUtils.getSecurityOption already takes the last segment, lowercases it
and strips dashes — so the canonical camel.component.http.trustallcertificates resolves to the same
trustallcertificates option as the camelCase form. No change was needed on the camel-core side.

camel.security.* stays excluded, in both forms.

Tests

Two added to CamelSecurityPolicyAutoConfigurationTest, injecting a real SystemEnvironmentPropertySource so
the name arrives in native form rather than being pre-normalised by the test:

• policyShouldSeeInsecureOptionsSetThroughTheEnvironment — CAMEL_COMPONENT_HTTP_TRUSTALLCERTIFICATES=true
  now raises a violation, and the reported propertyKey is the canonical name
• environmentVariablesUnrelatedToCamelAreIgnored — a non-Camel variable whose last segment happens to be a
  security option name (SOME_OTHER_TRUSTALLCERTIFICATES) must not raise one

Verified meaningful: the first fails against main (no violation detected), the second passes either way as a
negative control. Full core/camel-spring-boot suite: 140 tests, 0 failures. Root reactor build green.