[WFCORE-6860][WFCORE-6861][WFCORE-6862] CVE-2024-6162 CVE-2024-27316 Upgrade Undertow, XNIO and JBoss Remoting

[fl4via]

Jiras:
https://issues.redhat.com/browse/WFCORE-6860
https://issues.redhat.com/browse/WFCORE-6861
https://issues.redhat.com/browse/WFCORE-6862

    Release Notes - XNIO - Version 3.8.16.Final

Bug

• [XNIO-434] - Make wakeupReads and wakeWrites invoke listener in closed channels (XNIO-427 Breaks wakeup calls contract)

    Release Notes - JBoss Remoting (3+) - Version 5.0.29.Final

Bug

• [REM3-413] - ClosedChannelException when NioSocketConduit.handleReady invokes write listener after read listener closes connection

Task

• [REM3-402] - Add README and other community documents

Component Upgrade

• [REM3-411] - For the 5.x+ branches bring the WildFly Elytron version inline with WildFly (2.4.2.Final)

Enhancement

• [REM3-409] - Test Remoting on JDK21
• [REM3-412] - For testing individual Elytron dependencies should be listed instead of the shaded jar

    Release Notes - Undertow - Version 2.3.14.Final

Sub-task

• [UNDERTOW-2400] - ResponseWriterTestCase fails because ServletinputStream is closed before read

Bug

• [UNDERTOW-2332] - CachingResource mishandling with TTL =0 and FS exhaustion
• [UNDERTOW-2334] - CVE-2024-6162 url-encoded request path information can be broken on ajp-listener
• [UNDERTOW-2378] - Adjust properly session timeout also in case when custom auth mechanisms are used
• [UNDERTOW-2383] - Canonicalized query string in redirect location can break included links
• [UNDERTOW-2385] - Memory leak in ThreadLocalCache
• [UNDERTOW-2389] - DefaultByteBufferPool leaks buffers for released threads
• [UNDERTOW-2405] - CVE-2024-27316 HTTP-2: httpd: CONTINUATION frames DoS
• [UNDERTOW-2407] - NullPointerException on DefaultByteBufferPool.close
• [UNDERTOW-2409] - Adjust properly session timeout also in case when GET requests with custom auth mechanisms are used

Component Upgrade

• [UNDERTOW-2391] - CVE-2023-5685 Upgrade XNIO to 3.8.16.Final

Enhancement

• [UNDERTOW-2408] - Make fields final in DefaultByteBufferPool when appliable

[yersan]

I think it could be unrelated, but org.wildfly.test.integration.microprofile.jwt.propagation.JWTIdentityPropagationTestCase(standalone-enabled-microprofile-test).testInvokeEJBWithinSingleDeploymentOutflowAnonymousConfigured has constantly failed three times on Windows (two for this PR and one for #6044)

It passed on Linux, let's kick it off again to see how it goes

[yersan]

@fl4via @ropalka thank you!