Provide more control over access to endpoint operations

This commit reworks the support for enabling and disabling endpoints,
replacing the on/off support that it provided with a finer-grained
access model that supports only allowing read-only access to endpoint
operations in addition to disabling an endpoint (access of none) and
fully enabling it (access of unrestricted).

The following properties are deprecated:

- management.endpoints.enabled-by-default
- management.endpoint.<id>.enabled

Their replacements are:

- management.endpoints.access.default
- management.endpoint.<id>.access

Similarly, the enableByDefault attribute on @Endpoint has been
deprecated with a new defaultAccess attribute replacing it.

Additionally, a new property has been introduced that allows an
operator to control the level of access to Actuator endpoints
that is permitted:

- management.endpoints.access.max-permitted

This property caps any access that may has been configured for
an endpoint. For example, if
management.endpoints.access.max-permitted is set to read-only and
management.endpoint.loggers.access is set to unrestricted, only
read-only access to the loggers endpoint will be allowed.

Closes gh-39046

spring-boot-project/spring-boot-tools/spring-boot-configuration-processor/src/main/java/org/springframework/boot/configurationprocessor/ConfigurationMetadataAnnotationProcessor.java

@@ -24,7 +24,9 @@ import java.util.ArrayDeque;
 import java.util.Deque;
 import java.util.LinkedHashMap;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 
 import javax.annotation.processing.AbstractProcessor;
@@ -45,6 +47,7 @@ import javax.tools.Diagnostic.Kind;
 
 import org.springframework.boot.configurationprocessor.metadata.ConfigurationMetadata;
 import org.springframework.boot.configurationprocessor.metadata.InvalidConfigurationMetadataException;
+import org.springframework.boot.configurationprocessor.metadata.ItemDeprecation;
 import org.springframework.boot.configurationprocessor.metadata.ItemMetadata;
 
 /**
@@ -104,6 +107,8 @@ public class ConfigurationMetadataAnnotationProcessor extends AbstractProcessor
 
 	static final String NAME_ANNOTATION = "org.springframework.boot.context.properties.bind.Name";
 
+	static final String ENDPOINT_ACCESS_ENUM = "org.springframework.boot.actuate.endpoint.Access";
+
 	private static final Set<String> SUPPORTED_OPTIONS = Set.of(ADDITIONAL_METADATA_LOCATIONS_OPTION);
 
 	private MetadataStore metadataStore;
@@ -149,6 +154,10 @@ public class ConfigurationMetadataAnnotationProcessor extends AbstractProcessor
 		return NAME_ANNOTATION;
 	}
 
+	protected String endpointAccessEnum() {
+		return ENDPOINT_ACCESS_ENUM;
+	}
+
 	@Override
 	public SourceVersion getSupportedSourceVersion() {
 		return SourceVersion.latestSupported();
@@ -291,13 +300,21 @@ public class ConfigurationMetadataAnnotationProcessor extends AbstractProcessor
 			return; // Can't process that endpoint
 		}
 		String endpointKey = ItemMetadata.newItemMetadataPrefix("management.endpoint.", endpointId);
-		boolean enabledByDefault = (boolean) elementValues.getOrDefault("enableByDefault", true);
+		boolean enabledByDefaultAttribute = (boolean) elementValues.getOrDefault("enableByDefault", true);
+		String defaultAccess = (!enabledByDefaultAttribute) ? "none"
+				: (elementValues.getOrDefault("defaultAccess", "unrestricted").toString()).toLowerCase(Locale.ENGLISH);
+		boolean enabledByDefault = "none".equals(defaultAccess) ? false : enabledByDefaultAttribute;
 		String type = this.metadataEnv.getTypeUtils().getQualifiedName(element);
 		this.metadataCollector.addIfAbsent(ItemMetadata.newGroup(endpointKey, type, type, null));
+		ItemMetadata accessProperty = ItemMetadata.newProperty(endpointKey, "access", endpointAccessEnum(), type, null,
+				"Permitted level of access for the %s endpoint.".formatted(endpointId), defaultAccess, null);
 		this.metadataCollector.add(
 				ItemMetadata.newProperty(endpointKey, "enabled", Boolean.class.getName(), type, null,
-						"Whether to enable the %s endpoint.".formatted(endpointId), enabledByDefault, null),
+						"Whether to enable the %s endpoint.".formatted(endpointId), enabledByDefault,
+						new ItemDeprecation(null, accessProperty.getName(), "3.4.0")),
 				(existing) -> checkEnabledValueMatchesExisting(existing, enabledByDefault, type));
+		this.metadataCollector.add(accessProperty,
+				(existing) -> checkDefaultAccessValueMatchesExisting(existing, defaultAccess, type));
 		if (hasMainReadOperation(element)) {
 			this.metadataCollector.addIfAbsent(ItemMetadata.newProperty(endpointKey, "cache.time-to-live",
 					Duration.class.getName(), type, null, "Maximum time that a response can be cached.", "0ms", null));
@@ -314,6 +331,17 @@ public class ConfigurationMetadataAnnotationProcessor extends AbstractProcessor
 		}
 	}
 
+	private void checkDefaultAccessValueMatchesExisting(ItemMetadata existing, String defaultAccess,
+			String sourceType) {
+		String existingDefaultAccess = (String) existing.getDefaultValue();
+		if (!Objects.equals(defaultAccess, existingDefaultAccess)) {
+			throw new IllegalStateException(
+					"Existing property '%s' from type %s has a conflicting value. Existing value: %b, new value from type %s: %b"
+						.formatted(existing.getName(), existing.getSourceType(), existingDefaultAccess, sourceType,
+								defaultAccess));
+		}
+	}
+
 	private boolean hasMainReadOperation(TypeElement element) {
 		for (ExecutableElement method : ElementFilter.methodsIn(element.getEnclosedElements())) {
 			if (this.metadataEnv.getReadOperationAnnotation(method) != null