[BUG] — `ComposableSignService.skipSignExchange`: 3× `String.format` per signed request

- severity: Medium
- files: `shenyu-plugin-security/shenyu-plugin-sign/.../service/ComposableSignService.java:234-236` (`String.format("%s-%s", PluginEnum.X.getName(), context.getRpcType())` inside `skipSignExchange`, invoked from `handleExchange` on every sign-enabled request)
- description: Three `String.format` calls (Formatter + StringBuilder + boxing) per signed request, when the module strings are static constants.
- impact: Per-signed-request allocation/boxing churn.
- suggested_fix: Precompute `private static final String SPRING_CLOUD_MODULE = PluginEnum.SPRING_CLOUD.getName() + "-" + ...` constants, or compare enum names directly without formatting.
- confidence: High

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start in shenyu-plugin-security/shenyu-plugin-sign/.../service/ComposableSignService.java at skipSignExchange and its call from handleExchange. Check the existing security-plugin tests before changing the three formatted module strings. Done means signed-request behavior is unchanged while the per-request String.format and related allocation are removed; run the module tests afterward.

Written by the indexing model from the issue text.