TTRWRKS-19: Migrate report-service to Java 17 / Spring Boot 3.2

[devin-ai-integration]

Summary

Cuts services/report-service over from Java 8 / Spring Boot 2.5.15 to Java 17 / Spring Boot 3.2.12 (TTRWRKS-19). First commit is pure OpenRewrite (org.openrewrite.java.spring.boot3.UpgradeSpringBoot_3_2: javax→jakarta, JUnit 4→5, Security 5→6, HttpClient 4→5, Java 17 build target, SpringFox→springdoc); second commit is the hand-fix sweep for what the recipe left behind. No behavior or API changes; no language modernization.

Hand fixes the recipe couldn't do:

• SecurityConfig — recipe emitted Security 6 DSL but left removed APIs:

  -  .headers(h -> h.frameOptions(o -> o.deny().contentTypeOptions())
  -                 .xssProtection(x -> x.block(true)))         // XXssConfig.block(boolean) is gone
  +  .headers(h -> h.frameOptions(HeadersConfigurer.FrameOptionsConfig::deny)
  +                 .xssProtection(x -> x.headerValue(ENABLED_MODE_BLOCK)))

  Swagger matchers retargeted from the SpringFox paths (/swagger-resources/**, /v2/api-docs/**) to springdoc's (/swagger-ui.html, /v3/api-docs/**), otherwise the docs endpoints 401.
• AppConfig — HttpComponentsClientHttpRequestFactory.setReadTimeout no longer exists; the read timeout now rides on the HttpClient 5 pool as ConnectionConfig.setSocketTimeout(...), so otterworks.report.read-timeout keeps working.
• SwaggerConfig — the recipe deleted the Docket bean but left an orphaned Info helper, so the service would have served the default (untitled) OpenAPI doc; re-exposed as @Bean OpenAPI.
• pom.xml — dropped the recipe's redundant pins the Boot parent manages (httpclient5.version, surefire), removed dead springfox/commons-lang properties and the junit-jupiter exclusion.
• application.properties — removed the SpringFox spring.mvc.pathmatch.matching-strategy=ant-path-matcher workaround and the explicit hibernate.dialect (Hibernate 6 auto-detects and warns on it); unquoted springdoc.packages-to-scan, which the recipe wrote with literal quotes.
• Dockerfile builder/runtime on Temurin 17; ci.yml report-service job and the docker-build.yml test gate on Temurin 17 with Maven caching (mvn -B verify instead of the compile/test/package trio).
• Docs/chart descriptions that asserted "Java 8 / Spring Boot 2.5" for this service.

No javax.* imports remain. Follow-ups (deliberately out of scope): iText 5 → OpenPDF, POI 4 → 5.2, Guava 28 → 33, commons-io bump, and re-enabling Trivy scanning for this service.

Supersedes the earlier in-flight attempt in #6 (that branch also touched legacy-portal).

Link to Devin session: https://app.devin.ai/sessions/1f2e94e7f53346bdb383f4db144a82de
Open in Devin Desktop: https://app.devin.ai/desktop/session/1f2e94e7f53346bdb383f4db144a82de?variant=devin

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.