Protect against transitive additional meta-data

Update ConfigurationMetadataAnnotationProcessor to ensure that only
local `additional-spring-configuration-metadata.json` files are merged
with the final output.

See gh-1830

spring-boot-tools/spring-boot-configuration-processor/src/main/java/org/springframework/boot/configurationprocessor/ConfigurationMetadataAnnotationProcessor.java

@@ -275,6 +275,10 @@ public class ConfigurationMetadataAnnotationProcessor extends AbstractProcessor
 			FileObject manualMetadata = this.processingEnv.getFiler().getResource(
 					StandardLocation.CLASS_PATH, "",
 					"META-INF/additional-spring-configuration-metadata.json");
+			if (!"file".equals(manualMetadata.toUri().getScheme())) {
+				// We only wan't local files, not any classpath jars
+				return metadata;
+			}
 			InputStream inputStream = manualMetadata.openInputStream();
 			try {
 				ConfigurationMetadata merged = new ConfigurationMetadata(metadata);