NIFI-16135 Sanitize URL-derived segments used to build nifi-api requests

[mcgilman]

Add safeApiPath and isSameOriginTarget shared utilities and apply them to route/query-derived values in AccessPolicyService, DocumentationService, and the content viewer, so untrusted deep-link input cannot redirect authenticated requests or bypass the same-origin ref check.

Summary

NIFI-16135

Hardens the UI's handling of values that originate from the browser URL (route
parameters and query parameters) before they are used to build authenticated
nifi-api requests. These values can be influenced by a crafted link opened by
an authenticated user but were previously trusted as-is when constructing the
request path.

This adds two small shared utilities in libs/shared and applies them at the
points where URL-derived values reach a request:

• safeApiPath(...segments) — validates each value as a single, atomic path
  segment (rejecting path separators, .. traversal sequences including
  pre-encoded forms such as %2e%2e/%2f, control characters, empty and
  non-decodable values) and percent-encodes it. On an invalid segment it throws,
  so the caller fails closed and no request is issued. Legitimate values
  (identifiers and enumerated resource names) are unchanged, so existing URL
  shapes are preserved.
• isSameOriginTarget(candidate, base, { requireBasePathPrefix }) —
  canonicalizes both values and compares origins with a segment-boundary-aware
  path check, replacing a bypassable startsWith prefix check.

Applied to:

• DocumentationService — component/step documentation requests built from
  route-supplied definition coordinates.
• AccessPolicyService — policy requests built from route-supplied
  action/resource/identifier values. Affected methods are wrapped in defer(...)
  so a rejection surfaces on the observable error channel that callers already
  handle.
• ContentViewerComponent — the query-supplied content ref guard now uses a
  same-origin comparison instead of a string prefix match.

Unit tests cover the new validation and same-origin logic, including traversal,
pre-encoded traversal, control-character, look-alike-origin, and path-boundary
cases.

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using mvn clean install -P contrib-check
  • JDK 21
  • JDK 25

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[rfellows]

Thanks for the security fixes here @mcgilman 👍