Maintenance portlet: system config overrides displayed without obfuscation

Problem

The JVM Info screen in the maintenance portlet (GET /api/v1/jvm) obfuscates sensitive values in the System Properties and Environment Variables sections via JVMInfoResource.obfuscateIfNeeded() (masks values whose key matches passw|pass|passwd|secret|key|token, plus the configurable OBFUSCATE_SYSTEM_ENVIRONMENTAL_VARIABLES pattern).

The configOverrides section does not: getDBOverrides() copies SystemTable.all() straight into the response, so any secret stored as a system-table config override (API keys, tokens, passwords set via the UI/API) is rendered in plaintext to anyone with maintenance-portlet access.

Fix

Apply the same obfuscateIfNeeded(key, value) rules to the config-overrides map — one line in JVMInfoResource.getDBOverrides().

Security note

Read access already requires a backend user with the maintenance portlet, so exposure is limited to authenticated admins — but the whole point of the existing obfuscation is that even admins shouldn't see raw secrets on a screen that gets screenshotted into support tickets.

Start at JVMInfoResource.getDBOverrides() and compare how its configOverrides values are handled with the existing obfuscateIfNeeded() use for system properties and environment variables. Confirm the change preserves the existing key-matching and configurable pattern rules, and that sensitive config overrides are no longer returned in plaintext.