Security fixes

[tcezard]

Fix 1: Rate limiter bypass (RateLimiterAspect.java)
The rate limiter used the X-Forwarded-For HTTP header as the per-IP bucket key. Any client could rotate this header on every request to create unlimited fresh buckets, bypassing the 5 req/sec cap entirely. The fix removes the header trust and uses the TCP-level remoteAddr instead, which a client cannot spoof.

Fix 2: HTTP parameter injection (ContigAliasService.java)
Chromosome names and assembly values were concatenated directly into URLs sent to the internal contig-alias service, without encoding. A crafted regionId containing ? or # characters could inject extra query parameters into those internal requests. The fix replaces all four string-concatenation URL builds with UriComponentsBuilder, which percent-encodes all user-supplied path segments and query values automatically.

Fix 3: Plaintext password in memory (SecurityConfiguration.java)
The {noop} Spring Security prefix meant the admin password for the count-stats write API was stored and compared as plaintext in JVM heap memory. A heap dump would expose it immediately. The fix registers a BCryptPasswordEncoder bean and hashes the password at startup, so only the hash lives in memory.

Fix 4: Git metadata exposure (4 × application.properties)
management.info.git.mode=full caused the /actuator/info endpoint to publish the full commit SHA, commit message, and timestamp — enough for an attacker to precisely identify the deployed version and match it against known CVEs. Changed to simple, which only exposes the abbreviated commit hash and branch name.

Dep bump: PostgreSQL JDBC (pom.xml)
Driver 9.4.1212 (2017) was affected by several CVEs including SQL injection via column names (CVE-2022-31197) and XXE (CVE-2020-13692). Updated to 42.7.4, the current stable release, which is a drop-in replacement for PostgreSQL 11.

Dep bump: H2 (pom.xml, test scope)
H2 1.4.193 (2016) carried CVE-2021-42392 (RCE via JNDI in the H2 console) and CVE-2022-45868. Although test-scoped, it could be exploited in developer and CI environments. Updated to 2.2.224.