`LogbackAccessRequestLog` is registered as a bean, but doesn't implement `LifeCycle` (see qos-ch/logback#269).

If we manually implement `LifeCycle`, which the `RequestLogImpl` actually does with its methods, the component is registered as a managed object rather than a POJO and therefore is started and stopped by the Jetty server.

Closes #3226

Co-authored-by: Renovate Bot <[email protected]>

Co-authored-by: Renovate Bot <[email protected]>

Co-authored-by: Renovate Bot <[email protected]>

This allows us to drop a dependency on jcip-annnotations

…5152)

Co-authored-by: Renovate Bot <[email protected]>

Restrict the GitHub token permissions only to the required ones; this way, even if the attackers will succeed in compromising your workflow, they won’t be able to do much.

- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

[Keeping your GitHub Actions and workflows secure Part 1: Preventing pwn requests](https://securitylab.github.com/research/github-actions-preventing-pwn-requests/)

Signed-off-by: naveensrinivasan <[email protected]>

…5163)

Co-authored-by: Renovate Bot <[email protected]>

Co-authored-by: Renovate Bot <[email protected]>

Co-authored-by: Renovate Bot <[email protected]>

`StringLookup` is a functional interface and so `EnvironmentVariableLookup` can be implemented as a direct method reference to `System#getenv()`.

jUnit 5 introduces `DisabledIf` and `EnabledIf`, allowing tests or entire test classes to be disabled based on arbitrary conditions.

###### Problem:
Liquibase 4.x.x changed its file finding and handling. Therefore migration files in the `dropwizard-migrations` module were not found.

###### Solution:
Add root paths to the `FileSystemResourceAccessor`. Liquibase suggests adding the path `'/'` as a fix when migrating to 4.x.x. This seems to work on Linux, but not on Windows. So this PR adds the operating system specific root path (`C:\` for Windows and `/` otherwise). Additionally, the location of the code source is added (acquired through the `CloseableLiquibase` class).

This allows finding files with an absolute path and files located under `src/main/resources`, that are packaged into the jar as resources. Previously, it was possible to provide paths relative to the root folder of the project, which now isn't possible any more. However, the sources are unlikely to be deployed, so this should be enough in my opinion, when adding this behavior change to the migration guide. This also includes changes to be made to `.xml` files including other ones, as the include mechanism uses the same resolving strategy.

###### Result:
Users can specify custom files to the `dropwizard-migrations` module instead of using the default `migrations.xml`.

Resolves #5150

Co-authored-by: Renovate Bot <[email protected]>

… startup (#5197)

Fix broken link to the HttpClient docs. The previous link linked to `httpcomponents-core` version 4.3 docs, which doesn't seem to exist anymore.