CAMEL-23404: Improve SFTP security documentation and add strictHostKeyChecking policy enforcement

[davsclaus]

Summary

Improves documentation and adds security policy enforcement for the strictHostKeyChecking parameter in the SFTP component, as requested in CAMEL-23404.

Changes

1. Security Annotation (BaseSftpConfiguration.java)

• Added security = "insecure:ssl" to the strictHostKeyChecking parameter annotation
• Enhanced the description to explicitly warn about MITM vulnerability when set to no
• This enables the security policy framework to warn/fail when strictHostKeyChecking=no is used in production

2. Documentation (sftp-component.adoc)

• Added new "Security Best Practices: Host Key Verification" section
• Included WARNING admonition about the insecure default (strictHostKeyChecking=no)
• Provided multiple examples showing secure configuration patterns:
  • Using knownHostsFile with strictHostKeyChecking=yes
  • Using knownHostsUri for classpath-loaded known hosts
  • Relying on ~/.ssh/known_hosts (default behavior)
• Explained the relationship with the security policy enforcement framework

3. Generated Metadata (sftp.json)

• Regenerated component metadata to include the security: "insecure:ssl" attribute
• Updated parameter description in the JSON metadata

Test Plan

• Built camel-ftp-common and camel-ftp modules successfully
• Unit tests pass (56 tests run, 0 failures)
• Code generation executed successfully
• Verified generated JSON includes security attribute
• Manual verification: test SFTP connection with strictHostKeyChecking=yes (requires SFTP server)
• Security policy framework integration test (requires camel.security.insecureSslPolicy=fail)

Documentation

Documentation has been enhanced with:

• Clear warning about the security implications of the default value
• Multiple secure configuration examples
• Explanation of host key verification
• Links to security policy framework documentation

🤖 Generated with Claude Code on behalf of Claus Ibsen

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[davsclaus]

Added host key security options on component level so it can be configured globally and much easier