ESB-1296 Stop /api/health from creating sessions on every call

[MEM2677]

Code changes

• ApsTenantApplicationUtils.extractCurrentTenantCode gets the tenant manager from request.getServletContext() instead of the session, so the tenant lookup no longer creates a Redis session on every request.
• KeycloakSecurityConfig adds healthSecurityFilterChain (@order(60)), a stateless chain for /api/health only, with the same CORS and frame-options headers, so probes no longer create a container JSESSIONID session.
• ApsTenantApplicationUtilsTest adds a test that the tenant is resolved from the host name without creating a session, and its existing test now stubs the servlet-context lookup.
• MDCTenantFilterTest adds a test that the filter puts the domain's tenant into the MDC without creating a session.
• KeycloakSecurityConfigTest adds two tests that run both real security chains: /api/health creates no session, and other /api paths still do.

[github-actions]

PUBLICATION for COMMIT ID ``

IMG/TAG: entando/entando-de-app-tomcat:7.5.3-ESB-1296-PR379
IMG/SHA: entando/entando-de-app-tomcat@sha256:4dc2597758965125f05e8544245b81d1de125b9882423657981bd5edd296c6d7

[github-actions]

PUBLICATION for COMMIT ID ``

IMG/TAG: entando/entando-de-app-tomcat:7.5.3-ESB-1296-PR379
IMG/SHA: entando/entando-de-app-tomcat@sha256:03609cb92df260239c33e35ed96d23c75bf3b61c38f46d97ea6b55d5f1c13f6a

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
85.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

PUBLICATION for COMMIT ID ``

IMG/TAG: entando/entando-de-app-tomcat:7.5.3-ESB-1296-PR379
IMG/SHA: entando/entando-de-app-tomcat@sha256:940bfc5e8516b5a47c8aa496e01ef697bd7913e9158f6ccc6670ea3c7b2bb292