Backport JCA TLS trust validation fix for 2.12.1

[ROHIT SINGHAL (rohitsinghal4u)]

Description

Backports #50667 (314db42) for the stable azure-security-keyvault-jca 2.12.1 hotfix.

The target branch, hotfix/azure-security-keyvault, starts at the actual 2.12.0 release commit, 6b905e9 (#49921). Its JCA sources match the published 2.12.0 sources after accounting for declared dependency shading. No later beta feature changes are included.

The trust-manager implementation and all 161 regression cases are unchanged from the merged fix. The only cherry-pick conflict was the changelog; this PR adds only the TLS fix under 2.12.1 (2026-10-17), preserving prior published release history. The changelog links to this hotfix PR.

Updates the JCA patch version in version_client.txt, the module POM, README, and JCA test-harness dependency using the repository version-sync script. Synchronizes four existing JCA dependency references in the two Spring consumer POMs and the OpenRewrite POM to the published 2.12.0 dependency version, as required by the repository-wide version map. The JCA hotfix version remains 2.12.1. Other Key Vault libraries and JCA's runtime dependency versions are unchanged.

The current CI images use Maven 3.10 with Java 25. Compiler plugin 3.14.0's module-info transformer loads ASM 9.7.1, which rejects Java 25 class files. The shared azure-sdk-parent and independent clientcore-parent pin the compiler's build-only ASM dependency to the existing version-map value 9.9.1. This repairs compilation across the affected client, performance, and Spring source-build paths without changing runtime dependencies, bytecode compatibility targets, or validation gates.

Includes the existing upstream test-only ProxyOptionsTests isolation fix: explicitly set absent NO_PROXY and the higher-priority HTTPS_PROXY values in HTTP test configurations, rather than inheriting the Windows build agent's proxy environment. Test expectations and production proxy behavior are unchanged.

Validation

• Reproduced 14 Windows proxy-test failures using synthetic HTTP_PROXY, HTTPS_PROXY, and NO_PROXY settings; all 92 existing ProxyOptionsTests pass after the isolation fix on Java 25 and Java 8 under those same settings. Checkstyle and Spotless passed.
• Investigated the remaining Storage playback failure in CI run 6970534: a 60-second response timeout was followed by a repeated PUT after playback had advanced to GET, while the agent reported over 95% memory use. All seven unchanged uploadAndDownloadRegionLengthWithDiffBlobClients cases pass in isolated local playback. No Storage code, timeouts, recordings, assertions, or test exclusions were changed; the full CI rerun must confirm the timeout does not recur.
• Reproduced Unsupported class file major version 69 on unmodified hotfix code using Maven 3.10.0 and Temurin 25.0.4.1; the same azure-xml compile succeeds with the compiler-only ASM override.
• With the repaired CI toolchain, azure-json and ClientCore also compile; effective POMs confirm the override reaches the affected Azure parent families and Spring Cosmos.
• Maven 3.10 / Java 25: full JCA module clean verify succeeded; 243 cases, zero failures/errors, 29 environment-gated skips.
• Java 8u504: full JCA module test-only gates passed with the same counts; azure-xml compilation with the pinned compiler dependency also passed using CI's Java 8 formatter settings.
• Earlier Java 21 module verification passed, and all 161 trust-manager regressions passed against the packaged 2.12.1 JAR on Java 21 and Java 8.
• The rebuilt JCA JAR retains Java 8 class version 52 for KeyVaultTrustManager, does not bundle the compiler's ASM dependency, and retains the public signatures of published 2.12.0.
• The repository-wide POM version scanner passes with the complete metadata checkout, including the consumer version synchronization and both compiler overrides.

Contribution checklist

• Scoped to the merged TLS fix, its tests, consistent JCA version metadata, and build/test compatibility corrections required by current CI.
• Changelog updated without changing prior published entries or including later beta features.
• No public API signature changes; configured peer-identity enforcement is the intended correction.
• Repository contribution and versioning guidance followed.

This PR prepares the hotfix only. The changelog date does not publish the package; package publication remains a separate step. For the manual shared Key Vault release pipeline, select JCA only and deselect the other libraries.

[azure-pipelines]

Azure Pipelines:
Successfully started running 4 pipeline(s).
30 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.