feat(engine-rest): add REST authentication provider extensions

[hauptmedia]

Moved from operaton#3122 to operaton/operaton-backports.

Summary

Backports and adapts CIBSeven's REST authentication provider extensions for Operaton.

This adds two additional authentication modes to the engine REST authentication infrastructure:

• CompositeAuthenticationProvider: tries JWT bearer authentication first and falls back to HTTP Basic.
• PseudoAuthenticationProvider: authenticates a user id supplied by a trusted upstream component in the Context-User-ID header.

Operaton Run can now select these providers through operaton.bpm.run.auth.authentication, while keeping basic as the default mode.

What Changed

• Added CompositeAuthenticationProvider for JWT-first / Basic-fallback authentication.
• Added JwtTokenAuthenticationProvider using JJWT 0.12.6.
• Added JwtUser and JWT configuration loading from optional classpath resource operaton-plugins.properties with key authentication.jwtSecret.
• Added PseudoAuthenticationProvider for trusted-header authentication via Context-User-ID.
• Extended OperatonBpmRunAuthenticationProperties to accept basic, composite, and pseudo.
• Updated OperatonBpmRunRestConfiguration to register the selected provider class explicitly.
• Added JUnit 5/AssertJ tests for composite auth, JWT auth, pseudo auth, Run auth properties, and Run provider registration.

Reviewer Notes

• This is intentionally not a blind cherry-pick.
• Operaton keeps HTTP Basic as the default Run authentication mode. CIBSeven changed its default to pseudo auth; this PR does not do that.
• pseudo must be selected explicitly. Missing or blank Context-User-ID returns an unsuccessful authentication result in Operaton. CIBSeven's later follow-up allowed a missing header through as successful(null); that behavior is not carried over because it would make this trusted-header mode too easy to misconfigure.
• This PR does not enable new filters in packaged web.xml files. It adds provider classes and Run wiring; deployments that use static web.xml configuration can opt in by setting the authentication provider class themselves.
• JWT secrets are not shipped with a product default value. The default JWT provider reads authentication.jwtSecret from operaton-plugins.properties if present. In composite mode, missing or invalid JWT configuration simply makes the JWT provider fail and the Basic fallback can still authenticate the request.
• The CIBSeven multi-engine follow-up mainly changed URL-pattern handling for their Run/web.xml setup. Operaton Run already registers the auth filter on the Jersey REST mapping; the new tests verify provider selection while preserving that existing mapping behavior.
• Identity/setup whitelist changes are intentionally not part of this PR. They are handled separately in fix(engine-rest): whitelist identity verification endpoint operaton#3108 and feat(engine-rest): whitelist setup and password-policy auth paths #3.
• For Spring Security OAuth2 resource-server setups, see feat(starter-security): secure engine REST as OAuth2 resource server #1. This PR is for the standalone REST AuthenticationProvider extension point.

Attribution

Backported and adapted from CIB Seven:

• Commit: cibseven/cibseven@e9a960e
  • Original PR: feat(auth): implement composite authentication filter with JWT and Http Basic support cibseven/cibseven#49
  • Original author: Oleg Skrypnyuk oleg.skrypnyuk@cib.de
• Commit: cibseven/cibseven@86f3b3a
  • Original PR: feat(auth): custom header pseudo authentication cibseven/cibseven#73
  • Original author: Oleg Skrypnyuk oleg.skrypnyuk@cib.de
  • Original co-authors include Dmitry Malkovich dmitry.malkovich@cib.de and Patrick Fincke patrick.fincke@cib.de
• Commit: cibseven/cibseven@7a646ea
  • Original PR: Fix inconsistent indentation in CamundaBpmRunRestConfiguration cibseven/cibseven#243
  • Original author: Oleg Skrypnyuk oleg.skrypnyuk@cib.de
  • Original commit also includes Copilot/cibdmitrym/OlegCIB co-author trailers

Backport Database

• Change units: 820, 879, 1061
• Source fork: CIBSeven
• Target commit: dc739a0420ab13fc499ab8f3a11a4990d25ab889

Verification

• git diff --check
• git diff --cached --check
• ./mvnw -pl engine-rest/engine-rest -Dtest=CompositeAuthenticationProviderTest,JwtTokenAuthenticationProviderTest,PseudoAuthenticationProviderTest,HttpBasicAuthenticationProviderTest test
• ./mvnw -pl engine-rest/engine-rest -DskipTests install
• ./mvnw -pl distro/run/core -Dtest=OperatonBpmRunAuthenticationPropertiesTest,OperatonBpmRunRestConfigurationTest test