Add BODY_MULTIPART_COMBINED test to cover GetFilenamesFromMultiPartAdvice path

- New BODY_MULTIPART_COMBINED endpoint: calls getParameterMap() first (triggers
  GetFilenamesFromMultiPartAdvice via extractContentParameters -> getParts(MultiMap)),
  then getParts() explicitly (GetFilenamesAdvice must not double-fire since
  _contentParameters is already set)
- New test 'file upload filenames called once via parameter map' verifies the
  callback fires exactly once across both advice paths
- Enabled in Jetty 9.0, 9.0.4, 9.3, 9.4.21, 10.0 and 11.0

Author: jandro996

dd-java-agent/instrumentation-testing/src/main/groovy/datadog/trace/agent/test/base/HttpServerTest.groovy

@@ -372,6 +372,10 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {
     false
   }
 
+  boolean testBodyFilenamesCalledOnceCombined() {
+    false
+  }
+
   boolean testBodyFilenames() {
     false
   }
@@ -481,6 +485,7 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {
     BODY_URLENCODED("body-urlencoded?ignore=pair", 200, '[a:[x]]'),
     BODY_MULTIPART("body-multipart?ignore=pair", 200, '[a:[x]]'),
     BODY_MULTIPART_REPEATED("body-multipart-repeated", 200, "ok"),
+    BODY_MULTIPART_COMBINED("body-multipart-combined", 200, "ok"),
     BODY_JSON("body-json", 200, '{"a":"x"}'),
     BODY_XML("body-xml", 200, '<foo attr="attr_value">mytext<bar/></foo>'),
     REDIRECT("redirect", 302, "/redirected"),
@@ -1675,6 +1680,30 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {
     response.close()
   }
 
+  def 'test instrumentation gateway file upload filenames called once via parameter map'() {
+    setup:
+    assumeTrue(testBodyFilenamesCalledOnceCombined())
+    RequestBody fileBody = RequestBody.create(MediaType.parse('application/octet-stream'), 'file content')
+    def body = new MultipartBody.Builder()
+    .setType(MultipartBody.FORM)
+    .addFormDataPart('file', 'evil.php', fileBody)
+    .build()
+    def httpRequest = request(BODY_MULTIPART_COMBINED, 'POST', body).build()
+    def response = client.newCall(httpRequest).execute()
+
+    when:
+    TEST_WRITER.waitForTraces(1)
+
+    then:
+    TEST_WRITER.get(0).any {
+      it.getTag('request.body.filenames') == "[evil.php]"
+      && it.getTag('_dd.appsec.filenames.cb.calls') == 1
+    }
+
+    cleanup:
+    response.close()
+  }
+
   def 'test instrumentation gateway json request body'() {
     setup:
     assumeTrue(testBodyJson())

dd-java-agent/instrumentation/jetty/jetty-server/jetty-server-10.0/src/test/groovy/datadog/trace/instrumentation/jetty10/Jetty10Test.groovy

@@ -95,6 +95,11 @@ abstract class Jetty10Test extends HttpServerTest<Server> {
     true
   }
 
+  @Override
+  boolean testBodyFilenamesCalledOnceCombined() {
+    true
+  }
+
   @Override
   boolean testSessionId() {
     true

dd-java-agent/instrumentation/jetty/jetty-server/jetty-server-11.0/src/test/groovy/Jetty11Test.groovy

@@ -77,6 +77,11 @@ abstract class Jetty11Test extends HttpServerTest<Server> {
     true
   }
 
+  @Override
+  boolean testBodyFilenamesCalledOnceCombined() {
+    true
+  }
+
   @Override
   boolean testBlocking() {
     true

dd-java-agent/instrumentation/jetty/jetty-server/jetty-server-9.0.4/src/test/groovy/datadog/trace/instrumentation/jetty9/Jetty9Test.groovy

@@ -95,6 +95,11 @@ abstract class Jetty9Test extends HttpServerTest<Server> {
     true
   }
 
+  @Override
+  boolean testBodyFilenamesCalledOnceCombined() {
+    true
+  }
+
   @Override
   boolean testSessionId() {
     true

dd-java-agent/instrumentation/jetty/jetty-server/jetty-server-9.0/src/test/groovy/datadog/trace/instrumentation/jetty9/Jetty9Test.groovy

@@ -94,6 +94,11 @@ abstract class Jetty9Test extends HttpServerTest<Server> {
     true
   }
 
+  @Override
+  boolean testBodyFilenamesCalledOnceCombined() {
+    true
+  }
+
   @Override
   boolean testSessionId() {
     true

dd-java-agent/instrumentation/jetty/jetty-server/jetty-server-9.3/src/test/groovy/datadog/trace/instrumentation/jetty9/Jetty9Test.groovy

@@ -94,6 +94,11 @@ abstract class Jetty9Test extends HttpServerTest<Server> {
     true
   }
 
+  @Override
+  boolean testBodyFilenamesCalledOnceCombined() {
+    true
+  }
+
   @Override
   boolean testSessionId() {
     true

dd-java-agent/instrumentation/jetty/jetty-server/jetty-server-9.4.21/src/test/groovy/datadog/trace/instrumentation/jetty9/Jetty9Test.groovy

@@ -95,6 +95,11 @@ abstract class Jetty9Test extends HttpServerTest<Server> {
     true
   }
 
+  @Override
+  boolean testBodyFilenamesCalledOnceCombined() {
+    true
+  }
+
   @Override
   boolean testSessionId() {
     true

dd-java-agent/instrumentation/servlet/jakarta-servlet-5.0/src/testFixtures/groovy/datadog/trace/instrumentation/servlet5/TestServlet5.groovy

@@ -11,6 +11,7 @@ import java.lang.reflect.Field
 import java.lang.reflect.Modifier
 
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_MULTIPART
+import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_MULTIPART_COMBINED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_MULTIPART_REPEATED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_URLENCODED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.CREATED
@@ -71,12 +72,20 @@ class TestServlet5 extends HttpServlet {
           break
         case BODY_MULTIPART_REPEATED:
           resp.status = endpoint.status
-          // Call getParts() 3 times to verify the filenames callback fires only once
+        // Call getParts() 3 times to verify the filenames callback fires only once
           req.getParts()
           req.getParts()
           req.getParts()
           resp.writer.print(endpoint.body)
           break
+        case BODY_MULTIPART_COMBINED:
+          resp.status = endpoint.status
+        // Call getParameterMap() first (exercises GetFilenamesFromMultiPartAdvice via extractContentParameters),
+        // then getParts() explicitly (GetFilenamesAdvice must not double-fire since map is already set)
+          req.parameterMap
+          req.getParts()
+          resp.writer.print(endpoint.body)
+          break
         case BODY_MULTIPART:
         case BODY_URLENCODED:
           resp.status = endpoint.status

dd-java-agent/instrumentation/servlet/javax-servlet/javax-servlet-3.0/src/testFixtures/groovy/datadog/trace/instrumentation/servlet3/TestServlet3.groovy

@@ -15,6 +15,7 @@ import java.lang.reflect.Modifier
 
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_URLENCODED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_MULTIPART
+import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_MULTIPART_COMBINED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.BODY_MULTIPART_REPEATED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.CREATED
 import static datadog.trace.agent.test.base.HttpServerTest.ServerEndpoint.CREATED_IS
@@ -104,6 +105,14 @@ class TestServlet3 {
             req.getParts()
             resp.writer.print(endpoint.body)
             break
+          case BODY_MULTIPART_COMBINED:
+            resp.status = endpoint.status
+          // Call getParameterMap() first (exercises GetFilenamesFromMultiPartAdvice via extractContentParameters),
+          // then getParts() explicitly (GetFilenamesAdvice must not double-fire since map is already set)
+            req.parameterMap
+            req.getParts()
+            resp.writer.print(endpoint.body)
+            break
           case BODY_URLENCODED:
           case BODY_MULTIPART:
             resp.status = endpoint.status