Add ThreadContextPermission for markAsSystemContext and allow core to perform the method

[cwperks]

Description

This PR replaces a previous PR and takes a different approach to protect methods in the ThreadContext class. Instead of changing the access modifier, this PR shows how permissions can be declared to protect methods within the ThreadContext class that should not be accessible outside of the core without explicit permission.

With this change, plugins would be able to utilize the method but permission needs to be granted through an entry in the plugin-security.policy file. The permissions would be:

permission java.lang.RuntimePermission "markAsSystemContext";

Related Issues

Resolves #14931

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[cwperks]

for 2.x we could consider replacing the permission check with deprecation warning.

@reta How can the deprecation warning differentiate who the caller is though? The usage of the method is not deprecated in this repo so I would not want the message to display every time the method is called, only if its called from a class outside of the core.

[reta]

@reta How can the deprecation warning differentiate who the caller is though?

@cwperks Something along these lines:

 SecurityManager sm = System.getSecurityManager();
        if (sm != null) {
            try {
                sm.checkPermission(ACCESS_SYSTEM_THREAD_CONTEXT_PERMISSION);
            } catch (SecurityException ex) {
                deprecationLogger.warn( .,... )
            }
        }

[cwperks]

That's smart. Thanks @reta!

[cwperks]

Should I open up a manual backport with the change from here or wait for backport bot to create a backport and push a commit to the branch?

[github-actions]

✅ Gradle check result for 1ff09c2: SUCCESS

[reta]

Should I open up a manual backport with the change from here or wait for backport bot to create a backport and push a commit to the branch?

I will add backport label (so the changelog check passes), but we could take it from there