[JiaLiangC]

What changes were proposed in this pull request?

https://issues.apache.org/jira/browse/AMBARI-26653

Ambari still contains obsolete or affected dependencies, conflicting runtime
versions, and duplicate frontend dependency graphs. This PR implements the
remaining applicable dependency fixes from current source, grouped into
reviewable topic commits with compatibility changes and focused tests.

This PR also incorporates all three changes from #4207 (AMBARI-26652) in
separate commits: disable the empty Views tar assembly, restore agent assembly
metadata without changing archive names, and select the GlassFish JAXB runtime
while excluding the legacy EclipseLink XJC dependency.

• Upgrade BeanUtils to 1.11.0, remove unused Jettison, align Commons Compress
  1.28.0 and IO 2.21.0, upgrade agent Configuration2 to 2.15.0, and align the
  Jackson family at 2.18.9.
• Patch the selected frontend dependency families across React, Admin, and
  Files View. Keep compatible Vite 6.4.3/Vitest 3.2.7 toolchains, patch
  Nanoid/Browserslist/HumanFS/Immutable/brace-expansion/js-yaml, and verify
  nested dependencies. Preserve the existing Sass line in Admin.
• Make Yarn 1.22.22 and Node 22.23.1 the reproducible classic build path.
  Remove unused direct Express and obsolete duplicate manifests, lockfiles,
  and POM. Adapt the actual Brunch development server to Express 4.22.2,
  retain remote access, and test routing, malformed requests, and shutdown.
• Upgrade setuptools to 83.0.0 and regenerate its hashed build lock. Use a
  Python 3.10+ build environment while preserving Python 3.9.2+ runtime
  support. Update Maven, the installer, the Rocky 8 build image, and Jenkins
  to use the correct interpreter; install built wheels through an isolated
  runtime environment.
• Upgrade H2 to 2.5.250 with the legacy SQL compatibility mode and required
  identifier handling. Upgrade c3p0 to 0.14.2 with connection, recovery, and
  unsafe-serialization regression tests. Update MariaDB and SQL Server test
  drivers to 2.7.15 and stable 13.4.0.jre11, with real MariaDB DDL coverage.
• Align the two Spring example views at Spring 6.2.19 and Jakarta Servlet 6,
  remove unused invalid dependencies, and verify MVC dispatch, data
  migration, and deployable WAR/JAR packaging.
• Migrate the embedded server to Jetty 12.0.39 EE10, including Servlet 6,
  sessions, dynamic views, JSP, error handling, and Spring WebSockets.
  Preserve canonical view routing, class-loader restoration, failed view
  startup recovery, immediate message delivery, and reconnection. Exclude the
  unused Hadoop HTTP server stack from agent tools to prevent a Jetty 9/12 mix.
• Replace retired ApacheDS Kerberos APIs with Kerby 2.1.2 and align Directory
  API at 2.1.5. Preserve key derivation, keytab format/merge/permissions and
  unsigned KVNO behavior. KDC probes accept actual decoded Kerberos replies;
  malformed responses, local failures, and timeouts remain failures.

The Jetty and Kerberos contract/consumer migrations are atomic topic commits:
splitting each dependency switch from its API consumers would leave the
intermediate server compilation broken. Other workflows are separate commits.

The fixes cover the five earlier proposals (#4021, #3667, #4136, #4152,
#4153) and the remaining 26 reviewed proposals: #3594, #3609, #3610, #3717,
#4020, #4022, #4083, #4109, #4155, #4156, #4157, #4159, #4160, #4161, #4162,
#4183, #4185, #4190, #4191, #4192, #4193, #4194, #4196, #4197, #4199, #4200.
Replacement bot PRs can be closed after this PR is merged and verified.

How was this patch tested?

Validation used JDK 17.0.19, Maven 3.9.11, Node 22, and isolated Python build
and runtime environments. The final source reactor includes all dependency
contracts from this branch, without installing conflicting worktree snapshots.

The validation below applies to the dependency-remediation revision through
ad88859fdb. The three changes subsequently incorporated from #4207 were not
retested as part of this consolidation.

Validation	Result
Integrated server and agent Java suite	751 tests, 0 failures/errors, 3 existing skips
Spring examples and Views API source reactor	10 tests passed; WAR/JAR built and inspected
Python metadata/build-interpreter/sdist/tool tests	51 passed; Linux Python 3.9 runtime installation/imports and Rocky 8 builder passed
React UI	1,075 tests passed; clean install and build passed
Ambari Admin	223 tests and Istanbul coverage passed; clean install and build passed
Files View	12 tests passed; clean install, build, and zero audit findings
Classic Ember	22,259 tests passed, 662 existing skips; frozen install, build, real development-server smoke, RAT, and Maven package passed
Database boundaries	341 ORM/DAO/entity tests with 2 existing skips; real MariaDB 10.11 DDL test passed; JDBC URL/property tests passed
Security negative controls	Old BeanUtils, Jackson, and c3p0 versions fail the relevant protection assertions; upgraded versions pass

The final agent HTTP dependency exclusion was separately checked with all 15
credential/ZooKeeper tests and a runtime graph containing no Jetty or legacy
Servlet artifacts.

The final Node 22.23.1 integrated web package build also passed. The classic
Karma run and modern unit runs used Node 22.22.2; final Node 22.23.1 frozen
installation, builds, and real server smoke were checked separately.

Integrated Java command

env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -pl ambari-funtest,ambari-agent -am -DskipUiBuild=true -DskipAdminWebTests=true -DskipPythonTests=true -Dassembly.skipAssembly=true -Dsurefire.failIfNoSpecifiedTests=false -DforkCount=2 -DreuseForks=false '-Dtest=org.apache.ambari.server.orm.**.*Test,CommonsBeanUtilsSecurityTest,JacksonSecurityTest,ClientConfigArchiveTest,ClientConfigResourceProviderTest,MpackResourceProviderTest,ExecutionCommandWrapperTest,BootStrapResourceTest,JsonRequestBodyParserTest,JsonSerializerTest,H2DatabaseCompatibilityTest,C3p0ConnectionPoolTest,JdbcDriverCompatibilityTest,ConfigurationTest,KdcServerConnectionVerificationTest,ADKerberosOperationHandlerTest,IPAKerberosOperationHandlerTest,MITKerberosOperationHandlerTest,CreateKeytabFilesServerActionTest,KerberosHelperTest,DefaultLdapConfigurationServiceTest,DefaultLdapAttributeDetectionServiceTest,GroupMemberAttrDetectorTest,AmbariLdapBindAuthenticatorTest,AmbariKerberosAuthenticationFilterTest,AmbariKerberosAuthenticationPropertiesTest,AmbariKerberosTicketValidatorTest,KerberosKeytabsActionTest,ConfigureAmbariIdentitiesServerActionTest,StompWebSocketConfigurationTest,JettyWebSocketIntegrationTest,JettyViewJspIntegrationTest,AmbariHandlerListTest,AmbariSessionManagerTest,AmbariServerTest,AmbariErrorHandlerTest,AmbariViewErrorHandlerProxyTest,AmbariErrorHandlerIT,AmbariServerSecurityHeaderFilterTest,AmbariViewsSecurityHeaderFilterTest,SecurityFilterTest,ViewClassLoaderTest,AgentSessionManagerTest,CredentialStoreCreateTest,ZkMigratorTest,UpgradeCatalog310Test,SchemaUpgradeHelperTest' test

Additional integrated checks:

env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -DexampleViews -pl :hello-spring-view,:phone-list-upgrade-view -am -Dassembly.skipAssembly=true -DskipPythonTests=true verify
env JAVA_HOME=/opt/homebrew/Cellar/openjdk@17/17.0.19/libexec/openjdk.jdk/Contents/Home /tmp/apache-maven-3.9.11/bin/mvn -B -ntp -pl :ambari-web -am -DskipTests -DskipPythonTests=true package
/tmp/ambari-26653-validation-venv/bin/python -m unittest discover -s dev-support -p 'test_*.py'
git diff 474f6711c18663c29c0fc674053d21e7adcc2295..HEAD --check

Material validation limits: SQL Server's live container test is explicitly
skipped on this ARM host because the official image is amd64-only; its driver
contracts and integration test compile. The earlier empty Views API tar
descriptor required assembly.skipAssembly during the recorded runs; #4207's
incorporated fix disables that obsolete execution. The actual example WAR/JAR
were built in those runs. An exploratory full server sweep was interrupted and is not counted as
a passing full suite. Python product tests were skipped in Java-focused runs;
Python packaging/runtime checks were performed separately on Linux.

The existing React/Admin lint failures were reproduced from untouched base
0e30bef972; normalized before/after logs are identical (React: 5,190 errors,
387 warnings; Admin: 252 errors, 51 warnings). Selected dependency-family
audits are clear across all three modern apps. Other unrelated audit findings
remain outside this reviewed set, including the server's separate
Hadoop-transitive Configuration2 2.1.1; this PR does not claim a repository-wide
zero-vulnerability result or an exploitable endpoint solely from a version.

Please review Ambari Contributing Guide before opening a pull request.