ARTEMIS-4420 user auth leaks into non-Artemis servlets

[jbertram]

No description provided.

[jbertram]

@clebertsuconic, let's get this into 2.34.0. Can you review and merge? Thanks!

[gtully]

my understanding is the problem is with the filters setting thread locals and not clearing them, so even if the filters are only on specific contexts, the threads won't respect that, and the data will leak.

[gtully]

Using a thread local to propagate the session subject is fine, but it needs to be scoped to the user of that thread for the request, and cleared on response. so set every time.

[jbertram]

@gtully, point taken. I've updated the PR with what I believe will address the ThreadLocal issue. I wasn't able to come up with a way to test it automatically, but manual tests (e.g. the use-case outlined in the Jira) is working fine now.

[gtully]

that looks good to me.