[improve][misc] Upgrade Jetty to 12.1.12 - #26302

Motivation

Keep Pulsar on the latest Jetty 12.1.x patch release. Jetty 12.1.12 release notes: https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.12

Regarding security fixes: no published Jetty security advisory lists 12.1.12 as its patched version. The most recent Jetty CVEs (CVE-2026-10050 and CVE-2026-10051) were already addressed in 12.1.10, which Pulsar upgraded to previously.

12.1.12 does contain a number of correctness fixes in areas that Pulsar exercises directly — the reverse proxy in pulsar-proxy (AdminProxyHandler extends ProxyServlet from jetty-ee10-proxy), the WebSocket endpoints in pulsar-websocket, and the ForwardedRequestCustomizer that the broker, proxy, WebSocket proxy and function worker all install for original-client-IP resolution:

Proxy response headers (jetty-ee10-proxy AbstractProxyServlet, used by AdminProxyHandler):

• Question: AbstractProxyServlet onServerResponseHeaders addHeader rather than setHeader jetty/jetty.project#577 — onServerResponseHeaders now uses setHeader() instead of addHeader(), so a header already present on the proxy response (e.g. set by a servlet filter) is replaced rather than duplicated
• Review the lifecycle of WebSocket beans jetty/jetty.project#13691 — Server and Date headers were set twice when proxying
• Fix regression of duplicate header via proxy jetty/jetty.project#15531 — follow-up fix for a duplicate-header regression via the proxy

WebSocket:

• Fix for a potential NPE when accessing HTTP headers after a WebSocket upgrade
• Cleanups in RFC6455Handshaker and the WebSocket parser

HTTP:

• ForwardedRequestCustomizer uses connection port instead of proto default when host lacks port jetty/jetty.project#13970 — ForwardedRequestCustomizer no longer falls back to the connection port when the forwarded host carries no port; it uses the protocol default instead
• HttpServletResponse: setHeader("Content-Length", N) should be treated like setContentLengthLong(N) jetty/jetty.project#15453 — setHeader("Content-Length", N) is now treated like setContentLengthLong(N), which removes an extra empty HTTP/2 DATA frame and a second flush
• mime-type filtering by IncludeExclude should always be case-insensitive jetty/jetty.project#15496 — mime-type filtering via IncludeExclude is now consistently case-insensitive (relevant to the CompressionHandler mime-type matching behind GzipHandlerUtil)
• Fragments in redirects not supported by default in standalone Jetty installation jetty/jetty.project#15456 — redirect fragments; this one only changes the standalone distribution's etc/jetty-http-config.xml, so it does not affect Pulsar's embedded Jetty

Modifications

• Bump jetty from 12.1.11 to 12.1.12 in gradle/libs.versions.toml

• Update the Jetty artifact versions in distribution/server/src/assemble/LICENSE.bin.txt and distribution/shell/src/assemble/LICENSE.bin.txt

• Update the OW2 ASM entries in distribution/server/src/assemble/LICENSE.bin.txt from 9.10 to 9.10.1: Jetty 12.1.12's jetty-annotations / jetty-ee10-annotations bring in the newer ASM transitively. Verified with ./gradlew :distribution:pulsar-server-distribution:dependencyInsight --configuration distLib --dependency org.ow2.asm:asm.

• Initialize the AdminProxyHandler servlet in FunctionWorkerRoutingTest. The test called rewriteTarget() on a handler that was never initialized as a servlet. That worked until 12.1.12, where mime-type filtering by IncludeExclude should always be case-insensitive jetty/jetty.project#15496's companion change rewrote AbstractProxyServlet.validateDestination() to filter hosts through a single IncludeExclude; it now always dereferences the logger assigned by init(), whereas before it only did so when a whitelist/blacklist entry matched. The test consequently failed with an NPE on _log.

  This is a test-only gap, not a production regression: ProxyServiceStarter registers the handler through a ServletHolder, so the container calls init() and the logger is set. The test now initializes the servlet the same way and destroys it afterwards, which keeps the real validateDestination() path covered rather than working around it.

Verifying this change

• Make sure that the change passes the CI checks.

This change is already covered by existing tests. Besides the full CI run, the following Jetty-facing tests were run locally against 12.1.12 and pass:

• pulsar-proxy: the full module test suite (164 tests)
• pulsar-broker: org.apache.pulsar.broker.web.* (including WebServiceTest and WebServiceOriginalClientIPTest, which covers the ForwardedRequestCustomizer path)
• pulsar-websocket: the full module test suite
• GzipHandlerUtilTest and PulsarAdminGzipTest

./gradlew checkBinaryLicense and ./gradlew sanityCheck also pass.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment