docs: upgrade notes for the camel-spring-boot 4.23 default changes

[oscerd]

Adds a === camel-spring-boot section to camel-4x-upgrade-guide-4_23.adoc covering six starter defaults that
change in camel-spring-boot for 4.23. Docs only — no code in this repository is touched.

The camel-spring-boot upgrade notes live here rather than in that repository, following the precedent of
=== camel-spring-boot - Duration configuration properties in the 4.22 guide.

Note	camel-spring-boot PR	JIRA
jolokia binds to loopback; cross-origin rejected	apache/camel-spring-boot#1915 ✅ merged	CAMEL-24554
vault/secrets starters fail closed on early resolution	apache/camel-spring-boot#1900 ✅ merged	CAMEL-24508
undertow-spring-security validates issuer and audience	apache/camel-spring-boot#1910 ✅ merged	CAMEL-24497
platform-http enforces fileNameExtWhitelist	apache/camel-spring-boot#1897 ✅ merged	CAMEL-24496
security policy sees environment variables	apache/camel-spring-boot#1913 ✅ merged	CAMEL-24503
String conversions to file-backed types blocked	apache/camel-spring-boot#1912 ✅ merged	CAMEL-24504

All six changes are now merged on camel-spring-boot main, so these notes describe shipped behaviour and
this can merge whenever it suits. (An earlier version of this description said the PRs were still open — they
merged while this was in review.)

Each note says what changed, why, and how to opt back in where an opt-out exists
(camel.component.jolokia.server-config.host, camel.vault.ignore-resolution-failures,
camel.security.undertow.keycloak.validate-audience).

Two of the six are the ones most likely to surprise an operator:

• jolokia — a Kubernetes deployment scraping the agent over the pod network will lose it until
  camel.component.jolokia.server-config.host is set. The note calls that out specifically.
• security policy — an application on camel.security.policy=fail that configures Camel through the
  environment may now fail startup on a violation that was always present but previously invisible.

CAMEL-24499 also merged in this batch but needs no note: a serialization-filter fix with no user-facing
behaviour change.

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[github-actions]

🧪 CI tested the following changed modules:

• docs

---

🔬 Scalpel shadow comparison — Scalpel: 1 tested, 0 compile-only — current: 0 all tested

Maveniverse Scalpel detected 1 affected modules (current approach: 0).

⚠️ Modules only in Scalpel (1)

• docs

Skip-tests mode would test 1 modules (1 direct + 0 downstream), skip tests for 0 (generated code, meta-modules)

Modules Scalpel would test (1)

• docs

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

---

⚙️ View full build and test results

[gnodet]

Well-written upgrade guide entries for six camel-spring-boot 4.23 default changes. All referenced PRs are confirmed merged and the documented property names match the implementation. Two factual inaccuracies spotted in the text — see inline comments.

📋 PR Metadata

Aspect	Current	Suggested
Milestone	(none)	4.23.0

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet

[gnodet]

The JwtAudienceValidator.validate() method only checks the aud claim (via token.getAudience()). It never references the azp claim. The camel-spring-boot PR #1910 body explicitly states: "The azp claim identifies the requesting client and does not substitute for the resource audience."

The test rejectsMatchingAuthorizedPartyWhenAudienceTargetsAnotherService confirms that a matching azp does NOT satisfy the validator when aud does not contain the client ID.

Suggestion: remove "or azp" — change to:

requires the token to carry the configured clientId in its aud claim.

[oscerd]

Confirmed and fixed. I read JwtAudienceValidator.validate() on camel-spring-boot: it takes token.getAudience() and checks contains(clientId), with no reference to azp anywhere in the class. The note now says aud only.

Claude Code on behalf of oscerd

[gnodet]

The isFileBackedTarget() method in SpringTypeConverter checks FileReader.class.isAssignableFrom(type), not Reader.class.isAssignableFrom(type). Converting a String to Reader itself (or to non-file-backed subclasses like BufferedReader/StringReader) is still permitted.

Suggestion: change "Reader" to "FileReader":

FileReader, Writer and ZipFile targets are now refused for the same reason.

[oscerd]

Confirmed and fixed. isFileBackedTarget reads:

return InputStream.class.isAssignableFrom(type)
        || FileReader.class.isAssignableFrom(type)
        || Writer.class.isAssignableFrom(type)
        || ZipFile.class.isAssignableFrom(type);

so FileReader is the narrow one and Writer is genuinely broad, as the note had it. Changed Reader to FileReader and added a sentence saying that String to Reader itself, or to something like StringReader, still converts, since that is the part a reader of the old wording would have got wrong.

Claude Code on behalf of oscerd