perf(rest): inject ThriftClients as Spring bean across all REST services

[Aman-Cool]

perf(rest): centralize ThriftClients as a Spring bean across all REST services

What's happening

Every REST service class in rest/resource-server was constructing a new ThriftClients object at the point of use; inline expressions, per-method local variables, or field initializers that bypassed Spring entirely. Sw360ProjectService alone had 19 separate new ThriftClients() declarations across its methods.

ThriftClients is not lightweight, each instantiation reads connection config and sets up HTTP transport. More critically, instances using THttpClient internally open OS sockets that were never explicitly closed, causing the file descriptor leak documented in #3849 and #3760.

This PR declares ThriftClients as a single @Bean in Sw360ResourceServer and injects it into all 22 service classes via @RequiredArgsConstructor. The only remaining new ThriftClients() in the module is the factory method itself.

---

Prior work

• fix(projects): fix NPE and Thrift client leak in attachment usage inh… #3760, Fix/clearing request thrift client leak #3849 - identified and fixed Thrift client leaks in ProjectHandler and Sw360ClearingRequestService. Fix/clearing request thrift client leak #3849 established the shared-field pattern this PR extends to the whole module.
• test(clearingrequest): add unit tests for thrift client leak fix #3871, test(clearingrequest): verify shared ThriftClients instance across calls #3888 - tests proving the shared instance holds across calls.
• fix(rest): prevent silent data loss in obligation update #3614, fix: report errors instead of unconditional SUCCESS in CycloneDX SBOM… #3718, fix(projects): prevent data corruption and crashes in attachment usage inheritance #3773, fix(rest): delete clearing request only after project deletion succeeds #3788 - data integrity fixes that exposed how scattered inline Thrift construction makes error boundaries fragile.

---

Files changed (22)

Most files: add private final ThriftClients thriftClients; field, remove local vars / inline constructions, update call sites. 3-6 line change each.

Special case-SW360ReportService: had four eagerly-initialized Thrift client fields (new ThriftClients().makeProjectClient() etc.) at field declaration time. Field initializers run before the constructor, so they can't reference an injected field, these were removed and call sites now call thriftClients.makeXxxClient() directly, consistent with every other service in the module.

Excluded-Sw360UserService: receives ThriftClients as a method parameter in two static utility methods, different pattern, out of scope.

---

Migration roadmap

This is Step 1 of the [GSoC 2026 Thrift removal project]:

#3849	Step 0-shared field in one service, proved the pattern
This PR	Step 1-Spring bean, 22 injection points, zero ad-hoc construction
GSoC 2026	Step 2-merge REST + backend WARs; swap ThriftClients injections for direct @Service handler beans
GSoC 2026	Step 3-remove 30 IDL files, generated stubs, Thrift servlets, libthrift dependency

Step 2 is easier now: injection seams are already in place across all services.

---

Reviewer notes

• No behavior change, all method signatures, business logic, and exception handling are identical
• No test changes needed; existing integration tests cover correctness
• @RequiredArgsConstructor added to SW360RestHealthIndicator and Sw360UserDetailsProvider (the only two that didn't have it)

---

Issue: NA

---

Suggest Reviewers:

@GMishx @amritkv @rudra-superrr @bibhuti230185

---

Checklist

Must:

• All related issues are referenced in commit messages and in PR

[Aman-Cool]

@GMishx @amritkv, This picks up where #3849 left off, that PR consolidated one service to a shared field, this one promotes it to a proper Spring bean and rolls the same change across all 22 service classes. The diff looks big but it's the same 3-6 line change repeated: add the injected field, delete the local vars. No logic touched anywhere. Main thing worth a second look is SW360ReportService, it had four eagerly-initialized Thrift client fields that had to be handled differently since field initializers can't reference constructor-injected fields.