* Harden web console and Jolokia access by default

jetty.xml:
- Add Referrer-Policy and Permissions-Policy response headers; provide
  commented-out Strict-Transport-Security for HTTPS deployments.
- Wrap the existing HandlerCollection in an InetAccessHandler and restrict
  access to loopback (127.0.0.1, ::1) by default. Provide commented-out
  templates for RFC1918 includes and exclude rules.
- Tie Server.start() to the loopback include beans via depends-on so the
  allow-list is fully populated before the server starts.
- Add a commented-out ForwardedRequestCustomizer for reverse-proxy setups,
  with a warning about header spoofing when the proxy does not strip
  inbound X-Forwarded-* headers.

jolokia-access.xml:
- Restrict Jolokia to HTTP POST to kill GET-based CSRF/SSRF vectors.
- Deny destructive and privileged broker operations (terminateJVM, stop,
  restart, add/removeConnector, add/removeQueue/Topic, durable subscriber
  lifecycle, runtime limit setters, reloadLog4jProperties).
- Deny destination message-data mutation (purge, remove/copy/move
  messages, sendTextMessage*, pause/resume); browse* remains allowed.
- Deny durable subscriber destroy/setSelector and JobScheduler removeJob*.
- Deny NetworkConnector Password/RemotePassword attributes and credential
  setters.
- Deny known JMX RCE / introspection surfaces: javax.management.loading
  MLet, JMImplementation, java.util.logging, java.lang:type=Memory and
  ClassLoading, plus java.lang:type=Runtime SystemProperties and
  InputArguments.

* jetty.xml: restrict Jolokia endpoint to admins role

Add a jolokiaSecurityConstraintMapping that binds adminSecurityConstraint
(admins-only) to /api/jolokia/*, mirroring how *.action is gated on the
web console. Wired into securityHandler before securityConstraintMapping
so the admin role check applies to all Jolokia requests rather than the
broader users/admins constraint.

)

* Harden web console and Jolokia access by default

jetty.xml:
- Add Referrer-Policy and Permissions-Policy response headers; provide
  commented-out Strict-Transport-Security for HTTPS deployments.
- Wrap the existing HandlerCollection in an InetAccessHandler and restrict
  access to loopback (127.0.0.1, ::1) by default. Provide commented-out
  templates for RFC1918 includes and exclude rules.
- Tie Server.start() to the loopback include beans via depends-on so the
  allow-list is fully populated before the server starts.
- Add a commented-out ForwardedRequestCustomizer for reverse-proxy setups,
  with a warning about header spoofing when the proxy does not strip
  inbound X-Forwarded-* headers.

jolokia-access.xml:
- Restrict Jolokia to HTTP POST to kill GET-based CSRF/SSRF vectors.
- Deny destructive and privileged broker operations (terminateJVM, stop,
  restart, add/removeConnector, add/removeQueue/Topic, durable subscriber
  lifecycle, runtime limit setters, reloadLog4jProperties).
- Deny destination message-data mutation (purge, remove/copy/move
  messages, sendTextMessage*, pause/resume); browse* remains allowed.
- Deny durable subscriber destroy/setSelector and JobScheduler removeJob*.
- Deny NetworkConnector Password/RemotePassword attributes and credential
  setters.
- Deny known JMX RCE / introspection surfaces: javax.management.loading
  MLet, JMImplementation, java.util.logging, java.lang:type=Memory and
  ClassLoading, plus java.lang:type=Runtime SystemProperties and
  InputArguments.

* jetty.xml: restrict Jolokia endpoint to admins role

Add a jolokiaSecurityConstraintMapping that binds adminSecurityConstraint
(admins-only) to /api/jolokia/*, mirroring how *.action is gated on the
web console. Wired into securityHandler before securityConstraintMapping
so the admin role check applies to all Jolokia requests rather than the
broader users/admins constraint.

…ult (apache#2025) (apache#2037)

* Harden web console and Jolokia access by default

jetty.xml:
- Add Referrer-Policy and Permissions-Policy response headers; provide
  commented-out Strict-Transport-Security for HTTPS deployments.
- Wrap the existing HandlerCollection in an InetAccessHandler and restrict
  access to loopback (127.0.0.1, ::1) by default. Provide commented-out
  templates for RFC1918 includes and exclude rules.
- Tie Server.start() to the loopback include beans via depends-on so the
  allow-list is fully populated before the server starts.
- Add a commented-out ForwardedRequestCustomizer for reverse-proxy setups,
  with a warning about header spoofing when the proxy does not strip
  inbound X-Forwarded-* headers.

jolokia-access.xml:
- Restrict Jolokia to HTTP POST to kill GET-based CSRF/SSRF vectors.
- Deny destructive and privileged broker operations (terminateJVM, stop,
  restart, add/removeConnector, add/removeQueue/Topic, durable subscriber
  lifecycle, runtime limit setters, reloadLog4jProperties).
- Deny destination message-data mutation (purge, remove/copy/move
  messages, sendTextMessage*, pause/resume); browse* remains allowed.
- Deny durable subscriber destroy/setSelector and JobScheduler removeJob*.
- Deny NetworkConnector Password/RemotePassword attributes and credential
  setters.
- Deny known JMX RCE / introspection surfaces: javax.management.loading
  MLet, JMImplementation, java.util.logging, java.lang:type=Memory and
  ClassLoading, plus java.lang:type=Runtime SystemProperties and
  InputArguments.

* jetty.xml: restrict Jolokia endpoint to admins role

Add a jolokiaSecurityConstraintMapping that binds adminSecurityConstraint
(admins-only) to /api/jolokia/*, mirroring how *.action is gated on the
web console. Wired into securityHandler before securityConstraintMapping
so the admin role check applies to all Jolokia requests rather than the
broader users/admins constraint.

(cherry picked from commit be8415f)