- Add REQUEST_FILES_FILENAMES_ID=30 event to Events.java with
  BiFunction<RequestContext, List<String>, Flow<Void>> callback type
- Register case in InstrumentationGateway switch to wrap with try-catch
- Wire GatewayBridge: conditional registration, handler, cache field,
  reset, and IGAppSecEventDependencies entry
- Add unit tests in InstrumentationGatewayTest and GatewayBridgeSpecification

tag: ai generated
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Instrument ServletFileUpload.parseRequest() to extract filenames from
non-form-field FileItems and fire the requestFilesFilenames() IG event.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Certifies that the commons-fileupload instrumentation fires
server.request.body.filenames and the WAF can block on it end-to-end:
- Add /upload endpoint using ServletFileUpload.parseRequest() (mirrors
  client's fileupload.jsp pattern)
- Disable Spring multipart auto-config so Commons FileUpload handles
  the request before Spring intercepts it
- Add commons-fileupload:1.5 dependency to the smoke test app
- Add __test_file_upload_block WAF rule matching .jsp/.php/.asp/.aspx
  filenames and block request based on malicious file upload filename test

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Spring's MultipartAutoConfiguration was activating despite
spring.servlet.multipart.enabled=false in application.properties,
causing StandardServletMultipartResolver to consume the request
InputStream before Commons FileUpload could read it.

Explicitly exclude MultipartAutoConfiguration via @SpringBootApplication
so the raw InputStream is available to ServletFileUpload.parseRequest().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- InstrumentationGateway.java: restore alphabetical import order
  (REQUEST_FILES_FILENAMES_ID belongs after REQUEST_ENDED_ID)
- CommonsFileUploadAppSecModule.java: use NameMatchers.named instead of
  ElementMatchers.named, consistent with adjacent IAST instrumentation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>