Ship ONLY httpclient5 5.6.1

The shadow jar task merges two dependency sources: a `fileTree` copy of jars from
the ES source build (`elasticsearchMinimalCore`) and Maven-resolved
dependencies from `elasticsearch-java` (`elasticsearchClient`). Because
`elasticsearchMinimalCore` is listed first, its `httpclient5-5.5.jar` from
x-pack-core takes precedence over the patched `httpclient5-5.6.1.jar`
resolved via Maven from `elasticsearch-java 9.4.0`.

Exclude httpclient5, httpcore5, and httpcore5-h2 from the x-pack-core
module copy so the Maven-resolved versions are the sole source. This
ensures the plugin ships the patched `httpclient5` `5.6.1` regardless of
what version the ES server source build bundles.

Related:
- elastic/elasticsearch-java#1227
- elastic/elasticsearch#148345

Author: donoghuc

build.gradle

@@ -460,7 +460,14 @@ task importMinimalElasticsearch() {
             }
             from(shadeElasticsearchStableBridge.outputs.files.singleFile)
             from(shadeElasticsearchGrokImplementation)
-            from(buildElasticsearchLocalDistro.module("x-pack-core"))
+            from(buildElasticsearchLocalDistro.module("x-pack-core")) {
+                // Exclude httpclient5/httpcore5 jars so the Maven-resolved versions
+                // from elasticsearch-java (via elasticsearchClient config) are used instead.
+                // This ensures we always get the patched version (CVE-2026-40542).
+                exclude jarPackageNamed("httpclient5")
+                exclude jarPackageNamed("httpcore5")
+                exclude jarPackageNamed("httpcore5-h2")
+            }
 
             from(buildElasticsearchLocalDistro.module("ingest-common")) {
                 include jarPackageNamed("ingest-common")
@@ -562,6 +569,10 @@ task verifyImportedJars() {
         'org.brotli',
         'org.conscrypt',
 
+        // httpclient5/httpcore5 classes are excluded from the x-pack-core module copy
+        // and instead provided by the elasticsearchClient configuration (via elasticsearch-java)
+        'org.apache.hc',
+
         // ES internal packages not used in Logstash context
         'org.elasticsearch.cli',                    // CLI tools
         'org.elasticsearch.entitlement',            // Entitlement system