Audit follow-up: ProxyTool leaks CloseableHttpClient instances

Parent epic: #36004

Finding

ProxyTool appears to build a CloseableHttpClient per $proxy.send* request and never close it. The report also notes send() creates a default client and may then reassign it when credentials are supplied, orphaning the first client.

Report references: dotCMS/src/main/java/com/dotcms/ema/proxy/ProxyTool.java:94-138, dotCMS/src/main/java/com/dotcms/ema/proxy/ProxyTool.java:234-281

Potential impact

Under EMA / Velocity traffic the node may accumulate leaked connection pools, sockets, file descriptors, and threads, eventually causing OOM or FD exhaustion.

Suggested validation

Exercise $proxy.send* under load and inspect client/socket/thread lifecycle, especially credentialed requests.

Possible fix

Close per-request clients with try-with-resources, or preferably use a shared pooled client with clear ownership and lifecycle management.

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start in dotCMS/src/main/java/com/dotcms/ema/proxy/ProxyTool.java at lines 94-138 and 234-281, then exercise the $proxy.send* paths under load. Inspect client, socket, and thread lifecycles, including credentialed requests; done means the reported leak and possible orphaned default client are validated and client ownership is clear.