CXF-9171: DelayedCachedOutputStreamCleaner thread accumulation after CVE-2025-23184 fix

[reta]

The fix introduces 2 major improvements:

• delays the timer creation till at least one registration for cleanup happens
• introduces a cleanup strategy with new SingleTimerDelayedCleaner implementation for applications that may create a large number of Bus instances (based on the patch for the issue)
• additional Bus property to select the appropriate strategy

[aogburn]

And for the DelayedCachedOutputStreamCleaner currently, it still becomes leaky after 1 registered closeable for any bus that is not shutdown. So if it had a means of auto-closing its timer some time after the last registered closeable that would be better.

[reta]

And for the DelayedCachedOutputStreamCleaner currently, it still becomes leaky after 1 registered closeable for any bus that is not shutdown. So if it had a means of auto-closing its timer some time after the last registered closeable that would be better.

Thank you @aogburn , that is correct, but I think we should stay pragmatic here, if majority of applications has only one Bus instance, having a single timer that triggers every 30 mins is more than tolerable I believe.

[aogburn]

And for the DelayedCachedOutputStreamCleaner currently, it still becomes leaky after 1 registered closeable for any bus that is not shutdown. So if it had a means of auto-closing its timer some time after the last registered closeable that would be better.

Thank you @aogburn , that is correct, but I think we should stay pragmatic here, if majority of applications has only one Bus instance, having a single timer that triggers every 30 mins is more than tolerable I believe.

Thanks for the revisions. The DefaultDelayedCleaner timer thread creation is now truly lazy in my tests and thread/classloader leaks in my tests with multiple busses over time are corrected by the SingleTimerDelayedCleaner.

[ppalaga]

This is causing https://issues.apache.org/jira/browse/CXF-9172
Could we perhaps create the Timer lazily, when the first closeable is registered?

[ppalaga]

Something like this? #2706