CAMEL-23250: Security policy enforcement framework

Add a built-in security policy enforcement mechanism that detects
insecure configuration at startup and either warns or prevents the
application from starting, depending on the configured policy.

Framework components:
- SecurityUtils and SecurityViolation in camel-util for detection logic
- SecurityConfigurationProperties for camel.security.* configuration
- SecurityPolicyResult as a CamelContext plugin for runtime access
- SecurityPolicyHealthCheck for health monitoring
- Profile-aware defaults: prod profile auto-sets policy=fail
- security attribute on @UriParam/@UriPath/@metadata annotations
- Tooling support to generate security options map from annotations

Security categories: secret, insecure:ssl, insecure:serialization,
insecure:dev. Policy levels: allow, warn (default), fail.

Annotated 60+ component options across AWS, Huawei, JMS, Netty,
HTTP, Splunk, Paho, and other components with security categories.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: gnodet

components/camel-aws/camel-aws-bedrock/src/main/java/org/apache/camel/component/aws2/bedrock/agent/BedrockAgentConfiguration.java

@@ -65,7 +65,7 @@ public class BedrockAgentConfiguration implements Cloneable, AwsCommonConfigurat
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws-bedrock/src/main/java/org/apache/camel/component/aws2/bedrock/agentruntime/BedrockAgentRuntimeConfiguration.java

@@ -59,7 +59,7 @@ public class BedrockAgentRuntimeConfiguration implements Cloneable, AwsCommonCon
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws-bedrock/src/main/java/org/apache/camel/component/aws2/bedrock/runtime/BedrockConfiguration.java

@@ -59,7 +59,7 @@ public class BedrockConfiguration implements Cloneable, AwsCommonConfiguration {
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws-cloudtrail/src/main/java/org/apache/camel/component/aws/cloudtrail/CloudtrailConfiguration.java

@@ -59,7 +59,8 @@ public class CloudtrailConfiguration implements Cloneable, AwsCommonConfiguratio
     private String proxyHost;
     @UriParam(label = "proxy", description = "To define a proxy port when instantiating the Cloudtrail client")
     private Integer proxyPort;
-    @UriParam(label = "security", description = "If we want to trust all certificates in case of overriding the endpoint")
+    @UriParam(security = "insecure:ssl", label = "security",
+              description = "If we want to trust all certificates in case of overriding the endpoint")
     private boolean trustAllCertificates;
     @UriParam(defaultValue = "false",
               description = "Set the need for overriding the endpoint. This option needs to be used in combination with uriEndpointOverride option")

components/camel-aws/camel-aws-config/src/main/java/org/apache/camel/component/aws/config/AWSConfigConfiguration.java

@@ -53,7 +53,7 @@ public class AWSConfigConfiguration implements Cloneable, AwsCommonConfiguration
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws-parameter-store/src/main/java/org/apache/camel/component/aws/parameterstore/ParameterStoreConfiguration.java

@@ -54,7 +54,7 @@ public class ParameterStoreConfiguration implements Cloneable, AwsCommonConfigur
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws-secrets-manager/src/main/java/org/apache/camel/component/aws/secretsmanager/SecretsManagerConfiguration.java

@@ -54,7 +54,7 @@ public class SecretsManagerConfiguration implements Cloneable, AwsCommonConfigur
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws-security-hub/src/main/java/org/apache/camel/component/aws/securityhub/SecurityHubConfiguration.java

@@ -49,7 +49,7 @@ public class SecurityHubConfiguration implements Cloneable, AwsCommonConfigurati
     private String region;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws2-athena/src/main/java/org/apache/camel/component/aws2/athena/Athena2Configuration.java

@@ -136,7 +136,7 @@ public class Athena2Configuration implements Cloneable, AwsCommonConfiguration {
     @UriParam(label = "security")
     private String profileCredentialsName;
 
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;

components/camel-aws/camel-aws2-comprehend/src/main/java/org/apache/camel/component/aws2/comprehend/Comprehend2Configuration.java

@@ -57,7 +57,7 @@ public class Comprehend2Configuration implements Cloneable, AwsCommonConfigurati
     private String endpointArn;
     @UriParam
     private boolean pojoRequest;
-    @UriParam(label = "security")
+    @UriParam(label = "security", security = "insecure:ssl")
     private boolean trustAllCertificates;
     @UriParam
     private boolean overrideEndpoint;