[BUG] PluginJarParser.parseJar NPE on missing/incomplete pom.properties

- Severity: High
- Location:
`shenyu-web/src/main/java/org/apache/shenyu/web/loader/PluginJarParser.java:60-62`
-
Description:
`pluginJar.version = properties.get("version").toString(); pluginJar.artifactId = properties.get("artifactId").toString(); pluginJar.groupId = properties.get("groupId").toString();`. `Properties.get` returns `null` if the key is absent (hand-crafted jar, stripped `pom.properties`, or a `pom.xml`-only jar). `.toString()` on null → `NullPointerException`. If no `pom.properties` exists at all, `version`/`artifactId`/`groupId` stay null and `getJarKey()` returns `"null:null"`, colliding all such plugins into one cache slot.
-
Impact:
NPE aborts `parseJar`; in the upload path `ShenyuLoaderService.loadExtOrUploadPlugins` catches `Exception` broadly (line 94), so the whole load cycle silently fails with only a log line. Multi-plugin collisions on `"null:null"` corrupt the classloader cache.
-
Suggested fix:
Use `properties.getProperty(key, "")` with non-null defaults, or guard each `get(...)` with `Objects.requireNonNull` and throw a typed `ShenyuException` naming the jar/entry.
-
Confidence: High
- Related existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Start with shenyu-web/src/main/java/org/apache/shenyu/web/loader/PluginJarParser.java:60-62 and trace how missing or incomplete pom.properties values reach parseJar. Then inspect ShenyuLoaderService.loadExtOrUploadPlugins at line 94. Done means hand-crafted, stripped, and pom.xml-only jars no longer trigger an NPE or cause indistinguishable null:null plugin cache entries.

Written by the indexing model from the issue text.