docs: Routing Appender security considerations for high-cardinality keys

[SebTardif]

What Problem This Solves

When a default Route embeds an appender definition, the Routing Appender creates one subordinate appender per distinct routing key. If the key comes from untrusted or high-cardinality data (for example ${ctx:userId}), that can exhaust file descriptors and memory.

Evidence

Issue #4181 describes FD exhaustion with a user-controlled routing key and file-backed routes. This PR documents the risk and mitigations (IdlePurgePolicy, low-cardinality keys, prefer appender references).

Summary

Adds a Security considerations section to the Routing Appender manual page, linked from the existing purge-policy discussion.

Fixes #4181

Validation

Documentation-only change under src/site/antora/.../appenders/delegating.adoc plus changelog entry.

[ramanathan1504]

The section only covers availability. The other half of what @ppkarwasz asked for
on #4181 is the threat model side: an untrusted key doesn't just create more appenders,
it ends up inside their config. I tried it on 2.26.1 and with
fileName="logs/${ctx:userId}.log" and a key of ../../../../tmp/x it writes /tmp/x.log
and doesn't report an error. One thing to watch: the key has to be a whole path segment
for that to happen. logs/user-${ctx:userId}.log just fails to open, so the example
matters. Could you also add the threat model link he mentioned
(https://logging.apache.org/security.html#threat-common-sources-configuration) and a
line on why Routing is different from appenders that get built at config time?

@ppkarwasz can you look on this?

[SebTardif]

Thanks @ramanathan1504. Pushed an update that:

• Splits the section into Resource allocation and Threat model
• Notes that default routes build subordinate appenders at runtime, so lookups can still carry untrusted data when attributes are resolved (unlike config-time appenders)
• Adds the path-segment fileName="logs/${ctx:userId}.log" example (and the contrast with logs/user-${ctx:userId}.log)
• Links the configuration sources threat model and the path traversal FAQ
• Extends mitigations to path/URL/sink interpolation

Happy to adjust wording if @ppkarwasz wants a different emphasis.