[ISSUE #8219] Protect raw runtime configuration inspection without request-path overhead - #8283

Fixes #8219.

Problem

The bootstrap exposes the gateway's raw configuration caches through plain Spring controllers mapped under a hard-coded /actuator prefix (ShenyuControllerEndpoint in shenyu-web). Because HealthFilter dispatches every /actuator/* request straight to the DispatcherHandler, these mappings sit outside the request-plugin chain: anyone who can reach the gateway listener can anonymously read full plugin/selector/rule/metadata DTOs, and PluginData.config, selector and rule handles, and RPC metadata extensions routinely carry real credentials. The shipped management.endpoints.web.exposure.include=health,info setting does not help because these are not Actuator endpoints, and changing the Actuator base path or port does not move them.

Change

This PR makes raw cache inspection default-denied and opt-in with a bounded safe representation.

• ShenyuControllerEndpoint is now annotated with @ConditionalOnProperty(name = "shenyu.endpoint.raw-data.enabled", havingValue = "true", matchIfMissing = false), following the existing shenyu.diagnostics.enabled precedent: with shipped settings the controller bean is not registered at all, so anonymous requests are rejected before any cache traversal or JSON generation, and health/readiness/info mappings are untouched.
• When the property is explicitly enabled, the endpoints keep their paths but stop serializing raw DTOs: each entry now publishes only a non-reversible SHA-256 digest of the sensitive payload (PluginData.config, selector and rule handles, metadata path and RPC extension) plus non-secret structural counters, reusing the shared DiagnosticRedactor.digest() policy from the diagnostics subsystem instead of serializing-then-redacting per request.
• The endpoint javadoc also documents that these are plain MVC mappings unaffected by Actuator exposure or base-path settings. The forwarding path is not touched at all.

Tests

• ShenyuActuatorDispatchIntegrationTest drives the real reactive HTTP mapping (WebFlux DispatcherHandler behind HealthFilter, with a deny WebFilter standing in for the request-plugin chain): with shipped settings GET /actuator/pluginData returns 404 before any cache traversal; health-style mappings keep working; business paths still traverse the plugin chain and are denied 401 while the actuator dispatch bypasses it; and with the property enabled the endpoints return only the digest representation.
• ShenyuControllerEndpointTest seeds the caches with clearly marked fake secrets and asserts all eight endpoints answer with the bounded digest structure and never emit the raw config, handle or metadata material.

Verification

mvn -pl shenyu-web -am clean test -DskipTests=false
# 191/191 passing including checkstyle

Removing the @ConditionalOnProperty annotation turns the default-denied integration test red (404 becomes 200), confirming it guards the shipped behavior.

The denial path is bean-absence — the dispatcher answers 404 with no cache iteration, no DTO serialization and no JSON generation — and ordinary gateway forwarding is unmodified, so there is no regression on the request path. shenyu-bootstrap compiles against the change.