CAMEL-23250: Security policy enforcement with profile-aware defaults

[gnodet]

Summary

Adds a security policy enforcement system that detects insecure configuration at startup and warns or prevents the application from starting.

Reviewer note: This PR touches 570 files but most are auto-generated metadata. The key files to review are listed below with direct links.

Key Files to Review

Core implementation (new files):

• SecurityViolation.java — shared violation record
• SecurityUtils.java — detection logic + auto-generated security options map (13 entries)
• SecurityConfigurationProperties.java — policy configuration (allow/warn/fail, per-category overrides, allowlist)
• SecurityPolicyResult.java — context plugin for runtime access
• SecurityPolicyHealthCheck.java — readiness health check (uses reflection to avoid camel-health → camel-main dependency)

Integration points (modified files):

• BaseMainSupport.java — enforceSecurityPolicies() method (~line 2843)
• ProfileConfigurer.java — prod profile defaults policy to fail
• MainConfigurationProperties.java — securityConfig() wiring

Annotation definitions (3 attributes added: security(), insecureValue()):

• UriParam.java, Metadata.java, UriPath.java

Build tooling (reads annotations, generates SecurityUtils map):

• EndpointSchemaGeneratorMojo.java
• UpdateSensitizeHelper.java
• PrepareCamelMainMojo.java

Tests:

• MainSecurityPolicyTest.java — 25 tests covering policies, overrides, profiles, placeholders
• SecurityUtilsTest.java

Documentation:

• security.adoc — "Security Policy Enforcement" section (near end of file)

What can be skipped during review

• catalog/camel-catalog/src/generated/ — regenerated component JSON metadata (bulk of the diff)
• dsl/camel-endpointdsl/src/generated/ — regenerated endpoint DSL factories
• core/camel-main/src/generated/ — regenerated configurer and metadata JSON
• components/*/src/generated/ — regenerated per-component JSON
• Component annotation changes (57+ files, all 1-3 line additions of security = "insecure:ssl" etc.) — mechanical, can be spot-checked

---

Features

• Security policy enforcement with configurable policies (allow/warn/fail) under camel.security.* namespace
• Security categories: secret, insecure:ssl, insecure:serialization, insecure:dev
• Profile-aware defaults: camel.main.profile=prod defaults to fail; dev/test keep warn (overridable)
• Property allowlist: camel.security.allowedProperties to exclude specific properties
• Plain-text secret detection: flags passwords/tokens not using RAW(), {{vault:...}}, ${env:...}, or {{...}}
• Health check: SecurityPolicyHealthCheck readiness check reports violations at runtime
• Context plugin: SecurityPolicyResult for programmatic access to violations
• Annotation-driven: security and insecureValue attributes on @UriParam/@Metadata/@UriPath — build tools auto-generate the tracking map

Annotated Components (57+)

• SSL/TLS: trustAllCertificates, hostnameVerification, validateCertificates, ignoreSslVerification — AWS (37), Netty, Splunk, Paho MQTT, Huawei Cloud (7), core SSL
• Serialization: allowJavaSerializedObject, transferException, transferExchange, allowSerializedHeaders — JMS, Netty, Mina, HTTP
• Dev features: devConsoleEnabled, uploadEnabled, downloadEnabled, sendEnabled — management server

Test plan

• 25 tests in MainSecurityPolicyTest covering all policy levels, categories, overrides, allowlist, placeholders, context plugin, profile-aware defaults
• Build and verify with JDK 17, 21, 25
• Regenerated catalog, SecurityUtils, endpoint DSL, and all generated files

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using build-all, build-dependents, skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.