GHSA-j6qj-j888-vvgq Directory exposure in jetty

• Maven org.eclipse.jetty:jetty-deploy: >= 9.4.32, < 9.4.39 → fixed in 9.4.39 • Maven org.eclipse.jetty:jetty-deploy: >= 10.0.0, < 10.0.2 → fixed in 10.0.2 • Maven org.eclipse.jetty:jetty-deploy: >= 11.0.0, < 11.0.2 → fixed in 11.0.2

Impact If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. For example, the problem manifests in the following `${jetty.base}`: ```$ tree demo-base/ demo-base/ ├── etc ├── lib ├── resources ├── start.d ├── deploy │   └── async-rest.war └── webapps -> deploy ``` Workarounds Do not use a symlink