fix(server): configure finite DNS cache TTL

[bitflicker64]

Purpose of the PR

• close [Bug][HStore][Kubernetes] Data writes remain unavailable after Store pod replacement due to stale DNS resolution #3124

HugeGraph Server enables HugeSecurityManager by default. On Java 11, that
makes successful DNS resolutions remain cached for the JVM lifetime unless a
finite positive cache policy is configured. After a Kubernetes Store pod is
replaced behind the same stable DNS name, HStore writes can therefore continue
using the old pod IP until the Server process is restarted.

Main Changes

• Add a packaged Java security properties file with
  networkaddress.cache.ttl=30.
• Load that file through java.security.properties only when
  HugeSecurityManager is enabled.
• Fail fast when the bundled file is missing or unreadable unless the effective
  later operator override is non-empty.
• Keep security-disabled startup unchanged and preserve later operator JVM
  options, including an explicit security-properties override.
• Run focused Java runtime and launcher coverage in an independent RocksDB CI
  step.

The ordinary -Dnetworkaddress.cache.ttl system-property form is deliberately
not used because Java 11 reads this setting as a security property.

Verifying these changes

• Need tests and can be verified as follows:
  • Java 11 distribution package build: passed.
  • Java 11 and Java 17 security-property and launcher tests: passed.
  • Existing Server startup-script suite: 15 passed, 0 failed.
  • Workflow YAML parsing: passed.
  • Apache RAT validation for hugegraph-dist: passed.

Does this PR potentially affect the following parts?

• Dependencies
• Modify configurations
• The public API
• Other affects
• Nope

Documentation Status

• Doc - TODO
• Doc - Done
• Doc - No Need

Out of scope

• Store-client channel invalidation tracked by [Bug][HStore Client] gRPC stub pools bind every entry to one ManagedChannel #3125
• HStore readiness changes
• Helm chart changes

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 36.04%. Comparing base (b9710a7) to head (10ed6d2).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3126      +/-   ##
============================================
- Coverage     39.19%   36.04%   -3.15%     
- Complexity      264      424     +160     
============================================
  Files           770      770              
  Lines         65779    65779              
  Branches       8726     8726              
============================================
- Hits          25779    23710    -2069     
- Misses        37247    39424    +2177     
+ Partials       2753     2645     -108     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[imbajin]

Blocking: yes. Summary: The DNS TTL policy can silently disappear with a retained configuration directory, and its regression test can be skipped by unrelated startup prerequisites. Evidence: exact-head static review, a controlled missing-security-properties reproduction, workflow/log inspection, and git diff --check; codecov/project is failing.

[Copilot]

🟢 Ready to approve

The changes are narrowly scoped to Server startup wiring, include a packaged configuration, and add CI coverage validating both the security property value and argument ordering/overrides.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

This PR addresses stale JVM DNS caching when HugeGraph Server runs with HugeSecurityManager enabled (Java 11 behavior), which can prevent HStore writes from recovering after a Kubernetes Store pod is replaced behind the same DNS name.

Changes:

• Add a packaged security properties file setting networkaddress.cache.ttl=30.
• Wire the file into Server startup via -Djava.security.properties=... only when HugeSecurityManager is enabled.
• Add a dedicated CI startup-time verification script and run it in Server CI before existing startup tests.

File summaries

File	Description
hugegraph-server/hugegraph-dist/src/assembly/travis/test-java-security-properties.sh	Adds a focused runtime + launcher-argument test to verify the security property value and startup wiring behavior.
hugegraph-server/hugegraph-dist/src/assembly/static/conf/java-security.properties	Introduces the packaged security properties file that sets a finite positive DNS cache TTL.
hugegraph-server/hugegraph-dist/src/assembly/static/bin/hugegraph-server.sh	When security is enabled, adds -Djava.security.properties=... alongside HugeSecurityManager to ensure finite DNS caching.
.github/workflows/server-ci.yml	Runs the new security-properties verification script as part of the existing Server dist startup test step.

Review details

• Files reviewed: 3/4 changed files
• Comments generated: 0
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.