Clearing only on new/update endpoint access

Author: ValentinZakharov

dd-java-agent/appsec/src/main/java/com/datadog/appsec/api/security/ApiAccessTracker.java

@@ -52,24 +52,25 @@ public boolean updateApiAccessIfExpired(String route, String method, int statusC
     long currentTime = System.currentTimeMillis();
     long hash = computeApiHash(route, method, statusCode);
 
-    cleanupExpiredEntries(currentTime);
-
     // New or updated record
     boolean isNewOrUpdated = false;
     if (!apiAccessMap.containsKey(hash)
         || currentTime - apiAccessMap.get(hash) > expirationTimeInMs) {
+
+      cleanupExpiredEntries(currentTime);
+
       apiAccessMap.put(hash, currentTime); // Update timestamp
       // move hash to the end of the queue
       apiAccessQueue.remove(hash);
       apiAccessQueue.addLast(hash);
       isNewOrUpdated = true;
-    }
 
-    // Remove the oldest hash if capacity is reached
-    while (apiAccessQueue.size() > this.capacity) {
-      Long oldestHash = apiAccessQueue.pollFirst();
-      if (oldestHash != null) {
-        apiAccessMap.remove(oldestHash);
+      // Remove the oldest hash if capacity is reached
+      while (apiAccessQueue.size() > this.capacity) {
+        Long oldestHash = apiAccessQueue.pollFirst();
+        if (oldestHash != null) {
+          apiAccessMap.remove(oldestHash);
+        }
       }
     }