[BUG] JsonUtil.replaceJsonNode overwrites same-named leaf keys in sibling subtrees (cryptor field-scoped encrypt/decrypt corruption)

- Severity: High
- Location:
`shenyu-plugin/shenyu-plugin-security/shenyu-plugin-cryptor/src/main/java/org/apache/shenyu/plugin/cryptor/utils/JsonUtil.java:93-131` (buggy shared `AtomicInteger initDeep` at `:116-122`); reached via `MapTypeEnum.java:43-47`/`:107-116`
-
Description:
`replaceJsonNode` walks the JSON tree using a single shared `AtomicInteger initDeep` that increments whenever *any* entry key equals `deepKey.get(initDeep.get())`. After descending into the target path `a.b` and matching the leaf `"b"`, the pointer is left at `size-1` (line 121 `initDeep.set(deepKey.size() - 1)`). Subsequent sibling subtrees at the root are then visited with `initDeep` still at the leaf level, so any key named `"b"` inside *any* sibling object also matches `deepKey[leaf]`, increments to `size`, and gets overwritten with the encrypted/decrypted value. Verified trace for body `{"a":{"b":1},"c":{"b":2}}` with field path `a.b`: returns `{"a":{"b":"X"},"c":{"b":"X"}}` — i.e. `c.b` is also encrypted. For multi-field configs, `MapTypeEnum.map(originalBody, modifiedPairs)` calls `ALL.map` once per field with a fresh `AtomicInteger(0)`, so each dotted field independently overwrites every same-named leaf in every sibling subtree.
-
Impact:
Configuring the cryptor to encrypt/decrypt a nested field `x.y` causes every field named `y` under every sibling object of `x` to be encrypted/decrypted too — silent data corruption of fields the operator did not intend to touch.
-
Suggested fix:
Do not share mutable depth state across siblings. Descend only along the matching key and reset/branch the depth per subtree (recurse with a copy of the depth, or only follow the single matching key and leave all other entries untouched once the path is exhausted).
-
Confidence: High (verified by manual trace through the algorithm)
- Related existing: none

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._

Start in shenyu-plugin/shenyu-plugin-security/shenyu-plugin-cryptor/src/main/java/org/apache/shenyu/plugin/cryptor/utils/JsonUtil.java:93-131, then trace callers in MapTypeEnum.java:43-47 and :107-116. Reproduce the a.b case with sibling c.b and inspect the existing cryptor tests or add regression coverage. Done means only the configured path changes, while same-named keys in sibling subtrees remain unchanged.

Written by the indexing model from the issue text.