fix(sync): validate trusted WebSocket master redirects before forwarding credentials (#8222) - #8242

Fixes #8222.

Problem

An advertised cluster master is currently trusted whenever it uses ws / wss and has a host. A trusted wss:// seed can therefore redirect the gateway to another host and even to plaintext ws://, and the same X-Shenyu-Sync-Token is attached to the new handshake. Because shenyu.cluster.schema defaults to http, a TLS-terminated Admin also advertises a plaintext master by default.

Change

• New MasterTargetPolicy validates every advertised master before a client — and therefore its credential headers — is constructed:
  • Trusted origins are the current connection, already-connected clients, configured seed origins and an explicit shenyu.sync.websocket.trusted-master-hosts list (host, host:port, or ws(s)://host:port).
  • A wss connection never follows a plaintext ws advertisement unless the operator sets shenyu.sync.websocket.allow-insecure-master-redirect=true. ws → wss upgrades remain allowed.
  • A rejected destination is logged by scheme/host/port only; the current trusted follower is kept, no client is created and no token is forwarded. Malformed URIs keep the existing fallback behavior.
• Seeds remain trusted by configuration. Master promotion, context paths, rediscovery and bounded reconnect/backoff are unchanged.
• Compatibility: The default policy trusts only seed/current origins. Deployments whose Admin advertises other cluster nodes must list all node origins in the seed URLs or the new allowlist. TLS-terminated Admins should set shenyu.cluster.schema=https so the advertised master is wss; an explicit insecure opt-in is required for plaintext.

Tests

• Policy unit tests cover seed/current/allowlist origins, host-only and host:port entries, different ports, ws ↔ wss transitions, the insecure opt-in, seeds without a scheme, and invalid schemes/missing current context.
• Service tests assert an untrusted advertised master and a wss → ws downgrade construct no client and do not close the trusted follower; an allowlisted master and the explicit insecure opt-in construct a client whose headers still carry the sync token.
• The real-socket redirect test now explicitly allowlists the advertised master port and keeps its token/Origin/namespace/port assertions; config getter/equality tests cover the new properties.

Verification

shenyu-sync-data-websocket: 161/161
starter-sync-data-websocket: 4/4
checkstyle: clean

The check runs only when a master advertisement is evaluated, not on request or sync-data paths; no DNS, remote authorization or per-frame work is added.