Do not add current request Swagger server

[eviltester]

Summary

• stop Swagger generation from inventing a synthetic current request server when the request origin is not configured
• keep reordering configured servers when the request matches localhost or the configured HTTPS production host
• add a regression proving unknown origins are not added to OpenAPI servers

Why

Production API Challenges can expose a backend request origin of http://apichallenges.eviltester.com. Swagger UI then defaulted to the generated current request server and made browser calls to HTTP from the HTTPS page. The API definition already declares the intended servers, so generated docs should only use configured servers.

Verification

• mvn -pl thingifier '-Dtest=uk.co.compendiumdev.thingifier.swaggerizer.SwaggerizerServerPreferenceTest,uk.co.compendiumdev.thingifier.adapter.httpserver.HttpRequestOriginTest' test
• mvn -pl thingifier -DskipTests install
• mvn -pl thingifier -DskipTests checkstyle:check@project-fqn-check
• mvn -pl challenger '-Dtest=uk.co.compendiumdev.uirouting.UiPagesAreReachableTest#canFetchDefaultOpenApiJsonForSwaggerUi+canFetchOpenApiJsonForSwaggerUiBehindHttpsProxy' test (from apichallenges, using locally installed Thingifier snapshot)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.