T2.4 follow-up: register PSSecurityHeadersFilter in delivery-tier webapp web.xml files

[natechadwick-intsof]

Summary

PR #95 added a reusable PSSecurityHeadersFilter (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS, X-XSS-Protection: 0) and registered it in the two main Rhythmyx webapps (secure + non-secure). The delivery-tier webapps — comments, feeds, forms, integrations, membership, metadata, polls — do not have any security-header filter, so they are currently missing these defenses.

Why

These webapps serve user-facing content (RSS feeds, comments, form submissions, membership profile pages, etc.). Without the response headers, they are vulnerable to:

• clickjacking (X-Frame-Options)
• MIME-sniffing attacks (X-Content-Type-Options)
• referrer leakage (Referrer-Policy)
• HTTPS downgrade on link-clicks (HSTS)

This is the same defense-in-depth that PR #95 added to the main Rhythmyx webapps.

Scope

Seven web.xml files in the delivery-tier webapps:

• deliverytiersuite/delivery-tier-suite/comments/src/main/java/webapp/WEB-INF/web.xml
• deliverytiersuite/delivery-tier-suite/feeds/src/main/java/webapp/WEB-INF/web.xml
• deliverytiersuite/delivery-tier-suite/forms/src/main/java/webapp/WEB-INF/web.xml
• deliverytiersuite/delivery-tier-suite/integrations/src/main/java/webapp/WEB-INF/web.xml
• deliverytiersuite/delivery-tier-suite/membership/src/main/java/webapp/WEB-INF/web.xml
• deliverytiersuite/delivery-tier-suite/metadata/src/main/java/webapp/WEB-INF/web.xml
• deliverytiersuite/delivery-tier-suite/polls/src/main/java/webapp/WEB-INF/web.xml

Out of scope

• WebUI/war/WEB-INF/web.xml and system/ear/WEB-INF/web.xml — already have the existing PSSecurityHeaderFilter (com.percussion.utils.security.PSSecurityHeaderFilter), which is a richer filter that does X-Frame/XSS/HSTS/CSP/Cache-Control. Adding the new filter there would create duplicate header writes.
• Test resources (*src/test/resources*/web.xml, polls/resources/web.xml) — these are test fixtures, not production.
• Bundled Tomcat sample webapps (system/release/tomcat/Tomcat/webapps/{balancer,jboss-web,jmx-console,...}) — not built from source.
• The p13n-ds webapp has no <filter> block in its web.xml and ships a custom servlet container; it would need a structural change outside this slice's scope.

Verification

After the changes:

1. ./mvn-env.sh clean install -DskipTests -fae -B builds clean.
2. Each affected webapp's target/.../WEB-INF/web.xml shows the new <filter> and <filter-mapping> for PSSecurityHeadersFilter.
3. Each affected webapp's target/.../WEB-INF/lib/perc-security-utils-*.jar exists (so the filter class is on the classpath at deploy time).

Parent epic

Part of #72 (Dependency Upgrades) and #73 (117 GAVs / 504 CVEs). Builds on #94 / PR #95.

[natechadwick-intsof]

Fixed via #97 (PR opened, awaiting merge). The PSSecurityHeadersFilter (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS, X-XSS-Protection: 0) is now registered in the seven production delivery-tier webapp web.xml files: comments, feeds, forms, integrations, membership, metadata, polls.

WebUI/war and system/ear are deliberately not touched — they already have the existing PSSecurityHeaderFilter (com.percussion.utils.security.PSSecurityHeaderFilter), a richer filter that also handles CSP and Cache-Control, so adding the new one would create duplicate header writes.