Migrate report-service to Java 17 / Spring Boot 3.2 (TTRWRKS-21)

[devin-ai-integration]

Summary

Cutover of report-service from Java 8 / Spring Boot 2.5.15 to Java 17 / Spring Boot 3.2.12. Bulk of the diff is OpenRewrite's UpgradeSpringBoot_3_2 recipe (javax.* → jakarta.*, JUnit 4 → 5, Security 5 → 6 config style, Java 17 build target) in the first commit; the second commit is the hand sweep for what the recipe can't do.

Hand fixes worth reviewing:

• SecurityConfig: Security 6 removed XXssConfig.block(boolean) → .headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK).
• AppConfig: HttpComponentsClientHttpRequestFactory.setReadTimeout is gone in Spring 6, and HttpClient 4 → 5. Socket/connect timeouts now live on the connection manager:

  connectionManager.setDefaultConnectionConfig(ConnectionConfig.custom()
          .setConnectTimeout(Timeout.ofMilliseconds(connectionTimeout))
          .setSocketTimeout(Timeout.ofMilliseconds(readTimeout))
          .build());
  factory.setConnectTimeout(Duration.ofMillis(connectionTimeout));

• SpringFox → springdoc-openapi 2.5.0. The recipe drops the Docket bean but leaves the ApiInfo helper orphaned, so SwaggerConfig now exposes an @Bean OpenAPI; springdoc.* properties replace the SpringFox ones, and the spring.mvc.pathmatch.matching-strategy=ant-path-matcher workaround is dead and removed.
• pom.xml: dropped pins the Boot 3.2 parent already manages (surefire, compiler plugin version, Mockito, httpclient5), dropped the JUnit 4 dep and the JUnit 5 exclusion, dropped explicit servlet/validation APIs now supplied by the starters.
• Removed the explicit hibernate.dialect (Hibernate 6 auto-detects and warns on it).

Runtime/CI: Dockerfile builder+runtime → maven:3.9-eclipse-temurin-17 / eclipse-temurin:17-jre; ci.yml and docker-build.yml report-service jobs → Temurin 17 with cache: maven, mvn -B verify. README, CI strategy/SDLC docs, and the Helm chart description no longer claim Java 8 / Boot 2.5.

No modernization mixed in: no records/var/sealed sweeps, no JPMS, no test changes to make things pass, and java.util.Date/iText 5/POI 4 remain as pre-existing debt.

Local mvn -B verify on JDK 17: Tests run: 50, Failures: 0, Errors: 0, Skipped: 1, BUILD SUCCESS.

Ticket: TTRWRKS-21

Link to Devin session: https://app.devin.ai/sessions/e7de3a8019b9445d9efbd79b889cbaa4
Open in Devin Desktop: https://app.devin.ai/desktop/session/e7de3a8019b9445d9efbd79b889cbaa4?variant=devin

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

Devin Review found 0 new potential issues.