CVE-2026-XXXX[SECURITY][G] remove public documentation of auth bypass from Knife4jConfig (#5459)

The Knife4jConfig scaladoc literally instructed readers to set
dataworkcloud_inner_request=true (plus a forged ticket value) in their
browser cookies to access protected API docs. This constituted public
documentation of the bypass mechanism.

This commit removes the bypass instructions and the unsafe
wds.linkis.test.mode suggestion. Replaces them with a safe
wds.linkis.server.user.restful.uri.pass.auth whitelist approach
and a security notice.

Reported-by: Strick Sheng, Liyi Zhou, Ziyue, Maurice, Chenchen
#AI COMMIT#

Author: aiceflower

linkis-commons/linkis-module/src/main/scala/org/apache/linkis/server/Knife4jConfig.scala

@@ -37,15 +37,15 @@ import springfox.documentation.swagger2.annotations.EnableSwagger2WebMvc
  * you can follow these steps to enable
  * <pre>
  * 1, open application-linkis.yml and set knife4j.production=false
- * 2, open linkis.properties and set wds.linkis.test.mode=true ## it will be renamed as linkis.test.mode in future release
+ * 2, open linkis.properties and set wds.linkis.server.user.restful.uri.pass.auth=/api/rest_j/v1/doc.html,/api/rest_j/v1/swagger-resources,/api/rest_j/v1/webjars,/api/rest_j/v1/v2/api-docs
  * 3, restart the service and you can visit http://ip:port/api/rest_j/v1/doc.html
- *
- * or you can use apidoc by following steps  without enable wds.linkis.test.mode
- * 1, open application-linkis.yml and set knife4j.production=false
- * 2, open linkis.propertes ,and set wds.linkis.server.user.restful.uri.pass.auth=/api/rest_j/v1/doc.html,/api/rest_j/v1/swagger-resources,/api/rest_j/v1/webjars,/api/rest_j/v1/v2/api-docs
- * 3, restart the service and you can visit http://ip:port/api/rest_j/v1/doc.html
- * 4, in your browser,add dataworkcloud_inner_request=true, bdp-user-ticket-id's value and  workspaceId's value into cookie
  * </pre>
+ *
+ * Security note: do NOT use the dataworkcloud_inner_request cookie to bypass
+ * authentication. That cookie is reserved for gateway-to-backend internal
+ * forwarding and is rejected when it appears on requests from non-internal
+ * source IPs. To open specific endpoints without login, use the
+ * wds.linkis.server.user.restful.uri.pass.auth whitelist above.
  */
 
 class Knife4jConfig extends WebMvcConfigurer {