CAMEL-24634: Authorize with camel-opa in the camel-spiffe example - #264

What

Adds camel-opa (CAMEL-24634) to the spiffe example: SPIFFE keeps authenticating the callers, Open Policy Agent now decides what an authenticated caller may do.

• The shared WorkloadIdentityPolicy route configuration validates the JWT-SVID as before, then calls opa:camel/spiffe/<service>/allow with includeHeaders=CamelSpiffeSpiffeId,X-On-Behalf-Of, so OPA only sees the SPIFFE ID of the caller (and, on the second hop, on whose behalf it calls) plus the route id. The token never leaves the application. The CamelOpaDecisionAllow header drives the 403, and an OpaPolicyEvaluationException becomes a 503: the policy fails closed.
• The allow-lists move from application.properties to Rego: opa/backend.rego (who may call orders and audit) and opa/inventory.rego (the backend only, and only on behalf of a caller who may read the orders, by referring to the backend's permissions in the same OPA). opa/policy_test.rego holds 10 Rego unit tests, run with opa test.
• Compose gains an opa service (openpolicyagent/opa:1.9.0-static, policies bind-mounted, --watch so edits reload, console decision logs, port 8181 published). The README shows how to ask OPA directly, read its decision log, and change who may do what by editing the Rego file without rebuilding anything.
• AllowList is removed; the tests bind a mocked OPAClient (autowired by the component, like the SPIFFE client) that decides like the Rego policies and lets the tests check the input document sent to OPA.

Notes

• The OPA Java SDK declares Jackson 2.17 while Camel manages 2.22, and camel-bom does not manage Jackson, so the example imports jackson-bom at ${jackson2-version}. Without it the mix of jackson-databind 2.22 and jackson-annotations 2.17 fails at runtime.
• The bind mount of the policies uses the z flag so that it works on SELinux hosts.

Verification

18 unit tests and 10 Rego tests pass, Apache RAT passes, and the stack was run end to end: 200/403 matrix from OPA decisions, the inventory delegation rule, the decision log showing only the SPIFFE ID and the route id, and a direct query to OPA.