Exclude Apache CXF dependency from kvm plugin

[sudo87]

Description

Excludes Apache CXF (cxf-rt-frontend-jaxrs, and transitively cxf-core/cxf-rt-transports-http) from the KVM hypervisor plugin's bundled runtime dependencies, removing the CVE-2026-49875 / CVE-2026-50623 / CVE-2026-50633 / CVE-2026-50634 exposure on KVM agent hosts.

rebase of #13756

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

1. Dependency tree check: confirms CXF is no longer resolved for the KVM plugin module:
   mvn dependency:tree -pl plugins/hypervisors/kvm -Dincludes=org.apache.cxf
   output is empty after the fix

2. Build artifact check: confirms no CXF jars are copied into the agent's dependency bundle
   ls plugins/hypervisors/kvm/target/dependencies | grep -i cxf
   no result

How did you try to break this feature and the system with this change?

[sudo87]

@blueorangutan package

[blueorangutan]

@sudo87 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

[DaanHoogland]

clgtm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 16.26%. Comparing base (549daae) to head (2e92088).

Additional details and impacted files

@@ Coverage Diff @@## 4.20 #13799 +/- ##
============================================
- Coverage 16.26% 16.26% -0.01% + Complexity 13434 13433 -1 
============================================
Files 5667 5667 Lines 500731 500731 Branches 60803 60803 ============================================
- Hits 81455 81448 -7 - Misses 410172 410178 +6 - Partials 9104 9105 +1 

Flag	Coverage Δ
uitests	4.14% <ø> (ø)
unittests	17.12% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18777

[DaanHoogland]

@blueorangutan test ol9 kvm-ol9

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol9 mgmt + kvm-ol9) has been kicked to run smoke tests

[DaanHoogland]

@blueorangutan test ol10 kvm-ol10

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol10 mgmt + kvm-ol10) has been kicked to run smoke tests

[blueorangutan]

[SF] Trillian Build Failed (tid-16719)