feat(plugin): add policy-driven PII detection for AI traffic - #8105

Fixes #8048

Problem

sensitiveWord only rejects dictionary hits. It does not provide typed PII
detection, field-aware redaction, or AI protocol awareness.

This change adds policy-driven PII detection for supported AI JSON payloads
while preserving the existing reject-only behavior of sensitiveWord.

What this changes

A standalone piiDetection plugin is added at order 196, before aiProxy
at order 199. The plugin is disabled by default.

The first release supports:

• OpenAI chat completion payloads;
• OpenAI responses payloads;
• request-side scanning;
• non-streaming JSON response scanning.

Supported actions are BLOCK, REDACT and AUDIT.

Redaction is limited to extracted text slots. Tool definitions, function
arguments and unrelated JSON members are not scanned or rewritten. The
rewritten result preserves JSON tree semantics; JSON escaping, formatting,
key ordering and byte-level representation may be normalized by Gson
serialization.

Detection

Built-in detectors:

• EMAIL;
• PHONE_CN;
• NATIONAL_ID_CN;
• CREDIT_CARD.

Custom regular expressions are supported through the rule handle. The
configuration is bounded by entry count, per-regex length and total length,
and built-in detector names cannot be overridden.

Detection has a per-direction deadline. Audit records contain only detector
type, match count, direction, action and rule id. Detected values are not
written to logs or audit records.

Overlapping matches use the strictest action: BLOCK > REDACT > AUDIT.

Protocol profiles

The plugin supports:

• openai-chat: messages[].content and choices[].message.content;
• openai-responses: input and output[].content[].text.

Extraction containers and text member types are validated before scanning.
Malformed shapes follow the failure policy. Valid textless messages, such as
tool calls or image-only content, remain supported.

Successful Responses payloads containing "error": null are scanned normally.
A non-null upstream error envelope is passed through unchanged.

Bounds and failure policy

maxBodySize applies to request and response bodies and is measured in UTF-8
bytes. Negative values fall back to the default; 0 explicitly means
unlimited.

When failClosed=true, unsupported content types, malformed payloads,
unsupported streaming modes and oversized bodies are rejected before protected
content is written.

When failClosed=false, unsupported modes are passed through without scanning
and a warning is logged. Fail-open means “not detected”; it does not mean that
the content was checked and found clean.

Response inspection is limited to JSON responses in this release. SSE and
compressed responses are not scanned. A strict response scope rejects
stream: true requests before the upstream is called. When request scanning is
also enabled, fail-open request inspection marks the response to be skipped.
With scope=response alone, fail-open does not read the request body to inspect
the stream flag; SSE is skipped by response content type and supported JSON
responses remain eligible for response inspection.

Request aggregation is also bounded by spring.codec.max-in-memory-size.

Configuration

Invalid detector types, actions, scopes, timeout values and negative body
limits fall back to safe defaults with a warning. A custom-pattern size or
count violation rejects rule compilation rather than installing a partial
policy. A configured rule without a compiled policy rejects traffic instead of
silently bypassing inspection. Clearing the handle drops the compiled policy.

Assembly

The change includes:

• PII detection plugin module;
• Spring Boot starter and auto-configuration;
• parent and bootstrap wiring;
• PiiDetectionHandle;
• plugin README;
• MySQL, PostgreSQL, Oracle and H2 schema rows;
• plugin, handler, resource and permission configuration.

The generic console form can edit the handle because its fields remain
delimiter-separated.

Tests

The tests cover built-in detector boundaries, checksum validation, protocol
slot extraction, escaped text, JSON tree equivalence, false-positive
boundaries, action precedence, overlap merging, request and response bounds,
fail-open prefix replay, pooled buffer release, streaming prechecks,
configuration fallback, malformed protocol handling and starter registration.

Local validation passed:

PII module: 75 tests passed
Spring Boot starter: 4 tests passed
Checkstyle: 0 violations in both reactors

The local run used JDK 25, Maven 3.9.4, -Dnet.bytebuddy.experimental=true,
-Djacoco.skip=true and -DfailIfNoTests=false. The Maven Wrapper could not
download its distribution in this environment because the server returned
HTTP 403; the full JDK 17 ./mvnw clean install run remains for CI.

Known limitations

• SSE cross-chunk scanning is deferred;
• compressed response decoding and re-encoding are not supported;
• non-OpenAI protocol profiles are not included;
• reversible tokenization is not included;
• an audit event bus is not included;
• a dedicated concurrency test is still pending;
• aiResponseTransformer must not be enabled on the same traffic because its
  response decorator can replace the redacted body.

Checklist

• Contribution guidelines reviewed.
• Unit tests added for the changed behavior.
• Full ./mvnw clean install -Dmaven.javadoc.skip=true passed locally.