Merge master into 14.x

[velo]

Brings master (13.x line, through baeba5a7) into the 14.x release branch via a real merge commit, so master's history is preserved and future master→14.x merges stay cheap (a proper merge-base is recorded).

Conflict resolution

The dominant part of master's delta since the merge base was the streaming-bodies revert (#3409), which must not take effect on 14.x — the streaming Request.Body API is a deliberate v14 breaking change. Every revert-touched file was resolved toward 14.x. Because 14.x's streaming Body API is type-incompatible with the reverted byte[]-based API, the compiler verified that no revert slipped through silently.

Genuine master fixes carried in

• Dependency bumps: okhttp 5.4.0, jackson 2.22.0 / 3.2.0, spring-boot 4.1.0, spring 7.0.8, spring-cloud 2025.1.2, hibernate-validator (jakarta) 9.1.0, rewrite, handlebars 4.5.2, central-publishing 0.11.0
• Expressions: invalid value-modifier treated as literal (treat invalid expression value modifier as a literal #3437) + configurable max length (Make Expressions max length configurable (fixes #2916) #3422)
• Micrometer: open/stop observation scope on non-Feign errors (Open observation scope and stop on non-FeignException errors #3407)
• ErrorDecoder: guard numeric retry-after against long overflow (guard numeric retry-after against long overflow #3405)
• Multipart: SecureRandom boundary (generate multipart boundary from SecureRandom #3429), preserve delegate content-type (Preserve delegate content type for multipart parameters #3382), CRLF/quote escaping in headers (escape crlf and quotes in multipart Content-Disposition headers #3417), encode collection values with charset (encode collection values in urlencoded form bodies #3436), UTF-8 fallback for invalid charset (fall back to utf-8 for invalid content-type charset #3427) — re-applied onto 14.x's streaming writers
• Http2Client: honor jdk.httpclient.allowRestrictedHeaders (Honor jdk.httpclient.allowRestrictedHeaders in Http2Client (#2975) #3419) + cap Content-Length before narrowing to int (cap Content-Length before narrowing to int in Http2Client #3431) — re-applied onto 14.x's client; their new tests adapted to the streaming Body API

Notes for reviewers

• Restored the japicmp <excludes> for the v14 breaking types (feign.Request, feign.RequestTemplate, feign.mock.RequestKey, feign.vertx.VertxHttpClient) which the auto-merge had dropped from the parent POM.
• Return response body in FeignException from errorReading (#2618) #3415 (FeignException.errorReading returning the response body) was intentionally not carried: 14.x deliberately has errorReading return an empty body (its tests assert isEmpty()). Adopting Return response body in FeignException from errorReading (#2618) #3415 would reverse that decision — left as a follow-up if 14.x wants it.
• encode soap request body with the configured charset #3433 (soap charset) needs no port: 14.x already encodes the SOAP body from raw toByteArray() (no charset-corrupting String round-trip), which is exactly what encode soap request body with the configured charset #3433 fixes.

Verification

Full mvn clean install -Pdev passes locally — all modules compile, unit + integration tests green, all japicmp checks pass. The only local failures were Spring-Boot tests that bind a hardcoded port 8080 (occupied by an unrelated local service) and two network-dependent example ITs; both are environmental and unrelated to this merge.