KNOX-3361: Route OpenSAML off BouncyCastle in FIPS mode

[hanicz]

KNOX-3361 - Route OpenSAML off BouncyCastle in FIPS mode

What changes were proposed in this pull request?

New gateway-shim-opensaml-security-api module: a shaded drop-in for org.opensaml:opensaml-security-api that swaps upstream's GlobalNamedCurveRegistryInitializer for a Knox-owned wrapper. When Knox is running on a FIPS cluster, the wrapper short-circuits SPI-driven EC curve registration so AbstractNamedCurve.initialize() never invokes org.bouncycastle.jce.ECNamedCurveTable — preventing BouncyCastle EC code from executing. In non-FIPS deployments the wrapper delegates to the upstream initializer, preserving unmodified OpenSAML behavior.

ECDH-ES-encrypted SAML assertion decryption is not supported in FIPS mode (empty NamedCurveRegistry). RSA-signed and RSA-OAEP-encrypted SAML flows work identically in FIPS and non-FIPS.

This solution builds on what elasticsearch did, however for Knox it acts based on being on FIPS cluster or not.

How was this patch tested?

• Unit tests
  KnoxNamedCurveRegistryInitializerTest covers both branches:
  FIPS mode → registry empty, ECSupport.getNamedCurve returns null
  Non-FIPS mode → registry populated by upstream, ECSupport.getNamedCurve resolves secp256r1
• Tested classpath for installed Knox
• Tested RSA SAML with Keycloak for both FIPS and non-FIPS

Integration Tests

N/A

UI changes

N/A

[github-actions]

Test Results

32 tests   32 ✅  3s ⏱️
 1 suites   0 💤
 1 files     0 ❌

Results for commit af4ec7c.

[moresandeep]

Looks good.