CAMEL-24437/24439/24441/24443/24454: secure-default fixes, backport to camel-4.22.x

[oscerd]

Backport to camel-4.22.x of five fixes already reviewed and merged on main. These are grouped together because each changes a default or adds a check that was not there before, so they deserve a closer look than the other backports in this wave before going into a patch release.

• CAMEL-24454: camel-mllp - default logPhi to false and honour it on the paths that ignored it (CAMEL-24454: camel-mllp - default logPhi to false and honour it on the paths that ignored it #25832, dd2bf571)
• CAMEL-24443: camel-knative - do not trust every certificate when SSL is enabled without a truststore (CAMEL-24443: camel-knative - do not trust every certificate when SSL is enabled without a truststore #25824, 26c899d8)
• CAMEL-24437: camel-oauth - bind the authorization code callback to the flow with a state parameter (CAMEL-24437: camel-oauth - bind the authorization code callback to the flow with a state parameter #25821, 495c5ad3)
• CAMEL-24439: camel-shiro - verify the presented credentials on every exchange (CAMEL-24439: camel-shiro - verify the presented credentials on every exchange #25822, 6f72ae64)
• CAMEL-24441: camel-crypto-pgp - require integrity protection when decrypting (CAMEL-24441: camel-crypto-pgp - require integrity protection when decrypting #25848, 9d3108de)

What changes for an existing deployment:

• camel-mllp stops writing HL7 payload content to the log unless logPhi=true is set explicitly. Previously it defaulted to on, and two paths logged regardless of the setting.
• camel-knative with SSL enabled but no truststore configured no longer falls back to trusting every certificate. Such a deployment now needs a truststore, or trustAll set deliberately.
• camel-oauth rejects an authorization-code callback whose state does not match the one issued for that session. A deployment behind a proxy that drops or rewrites the callback query string would start seeing 400s.
• camel-shiro verifies the presented credentials on every exchange rather than accepting a subject already bound to the thread. alwaysReauthenticate=false keeps the old behaviour.
• camel-crypto-pgp refuses a decryption whose message has no integrity packet. requireIntegrityProtection=false restores the old acceptance.

Straight cherry-picks, applied in the order they merged on main. One mechanical adaptation, folded into the CAMEL-24437 commit: the new cases in OAuthProcessorFailClosedTest use JUnit assertions, since camel-oauth has no assertj test dependency on this branch and the rest of that file is JUnit.

The upgrade-guide entries are not included: the guides for every line live on main.

Built and tested per module on this branch (core, camel-crypto-pgp, camel-knative-http, camel-mllp, camel-oauth, camel-shiro), including the new and touched tests: PGPRequireIntegrityProtectionTest, PGPDataFormatTest, KnativeSslClientOptionsTrustTest, KnativeHttpTest, LogPhiTest, Hl7UtilTest, OAuthProcessorFailClosedTest, ShiroAuthenticationCredentialAlwaysCheckedTest.

Claude Code on behalf of oscerd

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[Croway]

There are uncommitted changes
HEAD detached at pull/25944/merge
Changes not staged for commit:
  (use "git add <file>..." to update what will be committed)
  (use "git restore <file>..." to discard changes in working directory)
	modified:   dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MllpComponentBuilderFactory.java

no changes added to commit (use "git add" and/or "git commit -a")


diff --git a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MllpComponentBuilderFactory.java b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MllpComponentBuilderFactory.java
index 024a459c66d8..9f5ef2ae9155 100644
--- a/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MllpComponentBuilderFactory.java
+++ b/dsl/camel-componentdsl/src/generated/java/org/apache/camel/builder/component/dsl/MllpComponentBuilderFactory.java
@@ -495,7 +495,7 @@ public interface MllpComponentBuilderFactory {
          * 
          * The option is a: &lt;code&gt;java.lang.Boolean&lt;/code&gt; type.
          * 
-         * Default: true
+         * Default: false
          * Group: advanced
          * 
          * @param logPhi the value to set

[oscerd]

Thanks — that was a real gap in the backport, not noise.

MllpComponentBuilderFactory is generated from the component descriptor, and main's logPhi commit did not carry the componentdsl mirror with it (main got that file regenerated separately), so the cherry-pick left the builder still documenting Default: true while mllp.json said false.

Regenerated it from this branch and folded it into the CAMEL-24454 commit. The resulting hunk is the single Default: true to Default: false line, and I diffed the logPhi block against main to confirm it matches. The same fix went onto the 4.18.x counterpart (#25946).

Claude Code on behalf of oscerd