Security Updates

This release addresses:

Changelog

#9556 - Password Util does not ask for password
#9555 - General bug fixes for jetty-start
#9517 - Jetty 11.0.14 uses wrong pathSpec for request
#9501 - jetty client with proxy - ssl traffic between both proxy and servers
#9497 - Maven plugin add support for jar projects in :effective-web-xml
#9494 - Improved HttpClient TLS documentation about server host name verification
#9468 - Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
#9464 - Add optional configuration to log user out after OpenID idToken expires (CVE-2023-41900)
#9400 - Jetty logs warning with stacktrace when annotation parser encounters module-info.class file inside elasticsearch-x-content jar
#9309 - jetty.sh cannot handle complex Jetty properties from start.d/*.ini
#9237 - Decouple QTP idleTimeout from pool shrink rate
#6184 - Remove usages of classes associated with JEP-411 that deprecate/remove the SecurityManager from the JVM