fix(#732): hide the CXF service list page by default

[oscerd]

Fixes #732

What

ServletExporter registered the CXF transport servlet with:

whiteboardProps.put("servlet.init.hide-service-list-page",
        getProp(properties, CXF_SERVLET_PREFIX + "hide-service-list-page", "false"));   // :76-77
...
whiteboardProps.put("servlet.init.service-list-page-authenticate",
        getProp(properties, CXF_SERVLET_PREFIX + "service-list-page-authenticate", "false"));   // :94-95

HTTPTransportActivator registers the ManagedService, so with no
org.apache.cxf.osgi configuration these defaults apply as-is — including on the
updated(null) path (:61-63), which is the shape a default install actually
takes. Installing the feature therefore published an enumerable, unauthenticated
listing of every CXF endpoint in the container at /cxf, with no configuration
step needed to turn it on.

How

hide-service-list-page now defaults to "true", making the listing opt-in.

I left service-list-page-authenticate alone: once the page is hidden by
default, turning it on is a deliberate act, and the authentication realm already
defaults to karaf for an operator who wants both. Flipping two defaults at
once would make the opt-in path harder to reason about.

An operator who wants the page back sets, in the org.apache.cxf.osgi PID:

org.apache.cxf.servlet.hide-service-list-page=false
org.apache.cxf.servlet.service-list-page-authenticate=true   # optional

which is recorded in a comment at the call site.

Tests

ServletExporterTest captures the whiteboard properties handed to
registerService and asserts:

• the default is "true" for an empty config
• and on the updated(null) path — that is the one a default install
  exercises, and it was a separate code path
• an explicit hide-service-list-page=false is still honoured, so the opt-in
  works
• the surrounding defaults (disable-address-updates,
  service-list-page-authenticate-realm, use-x-forwarded-headers, the servlet
  pattern) are unchanged

Tests run: 4, Failures: 0, Errors: 0, Skipped: 0
BUILD SUCCESS

The module had no test sources, so this adds the junit-jupiter and mockito
test dependencies.

Notes

• These values match historic upstream CXF defaults. CXF 4.x ships no OSGi
  transport module, so this glue is maintained here now and the default is ours
  to choose.
• Each endpoint's ?wsdl is reachable without authentication regardless, so this
  removes a discovery convenience rather than closing a disclosure channel —
  which is why it is a default change rather than a fix to the servlet itself.
• This is visible behaviour for anyone relying on the page and wants a release
  note. camel-cxf: CXF OSGi servlet registers with the service-list page enabled by default #732 also asked for the PID to be documented in the camel-cxf feature
  docs; docs/modules/ROOT/pages/components.adoc is currently just a pointer to
  camel-features.xml with no per-component pages, so there is no natural place
  for it yet — the call-site comment carries it yet.

---

Claude Code on behalf of Andrea Cosentino