Harden five anonymous-reachable surfaces from a private security report

Reported privately via security@apache.org on 2026-07-30 against
54de37f455. All five reproduce; four are fixed here, one (F3) is
hardened with an opt-in rather than treated as a vulnerability.

F1 CWE-918  WS-Addressing ReplyTo/FaultTo drive a server-initiated connection
            to a caller-chosen address. Screened in AddressingInHandler, at the
            inbound trust boundary, rather than in the transport sender, which
            also carries legitimate client calls. Link-local, wildcard and
            multicast refused always; loopback and private ranges behind
            blockPrivateNetworkResponseEndpoints.
F2 CWE-79   The Host reached an inline script unescaped in the Swagger UI page.
            URI.create did not neutralise it. Host validated, output encoded for
            the script context, inline block nonced under a CSP.
F3 CWE-644  servers[].url followed the request Host. Added openapi.serverBaseUrl
            to pin it; the request-derived default still follows the Host, as it
            does in comparable OpenAPI implementations.
F4 CWE-770  The multipart and form-urlencoded builders read the transport stream
            directly, so the container's post limit never applied. Both bounded,
            configurable per service. Multipart temp files are now deleted
            rather than accumulating.
F5 CWE-862  The .xsd/.wsdl file routes, HTTPWorker's named-WSDL route and the
            whole OpenAPI/MCP generator ignored exposeServiceMetadata.

CVEs to be requested after release, per the process followed for
CVE-2026-66713.