AccessDeniedException logging regression

# AccessDeniedException logging regression

Since upgrading to Git Parameter version `462.463.v496a_59f698e5` which implements the [fix for CVE-2026-57286](https://github.com/jenkinsci/git-parameter-plugin/commit/496a59f698e5ada712dea1ebf980709f0040e394) we've noticed that requests to the Jenkins API from a user with only `Job/Read` permission can produce an `AccessDeniedException` stacktrace in the Jenkins controller log.

The request itself still returns HTTP 200 with valid JSON.

## Reproduction steps

1. git-parameter plugin version `462.463.v496a_59f698e5`
2. The job contains a Git Parameter plugin parameter
3. The requesting user has `Job/Read` permission but does not have `Job/Build` permission

Example Request:
```
GET /job//api/json
```

## Observed behavior

Given the above conditions we observed the following behavior:

- HTTP response code: `200`
- Response body: valid JSON
- The response is missing the `GitParameterDefinition` entry completely
- Jenkins controller logs an AccessDeniedException stacktrace

Stacktrace

```
skipping export of net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition@a5ca16
hudson.security.AccessDeniedException3: anonymous is missing the „Element/Build“ permission
at hudson.security.ACL.checkPermission(ACL.java:79)
at hudson.security.AccessControlled.checkPermission(AccessControlled.java:52)
at PluginClassLoader for git-parameter//net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition$DescriptorImpl.doFillValueItems(GitParameterDefinition.java:734)
at PluginClassLoader for git-parameter//net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition.getAllValueItems(GitParameterDefinition.java:237)
at org.kohsuke.stapler.export.MethodProperty.getValue(MethodProperty.java:75)
Caused: java.lang.reflect.InvocationTargetException
at org.kohsuke.stapler.export.MethodProperty.getValue(MethodProperty.java:77)
at org.kohsuke.stapler.export.ExportInterceptor$1.getValue(ExportInterceptor.java:46)
Caused: java.io.IOException: Failed to write allValueItems:null
at org.kohsuke.stapler.export.ExportInterceptor$1.getValue(ExportInterceptor.java:56)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:141)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:239)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:311)
at org.kohsuke.stapler.export.Property.writeBuffered(Property.java:182)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:243)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:176)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:160)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:239)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:311)
at org.kohsuke.stapler.export.Property.writeBuffered(Property.java:182)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:243)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:176)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:160)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:239)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:235)
at org.kohsuke.stapler.export.Model.writeTo(Model.java:210)
at org.kohsuke.stapler.ResponseImpl.writeOne(ResponseImpl.java:350)
at org.kohsuke.stapler.ResponseImpl.serveExposedBean(ResponseImpl.java:339)
at org.kohsuke.stapler.ResponseImpl.serveExposedBean(ResponseImpl.java:290)
at hudson.model.Api.doJsonImpl(Api.java:259)
at hudson.model.Api.doJson(Api.java:239)
at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:733)
at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:484)
at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:497)
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:218)
at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:140)
at org.kohsuke.stapler.MetaClass$12.doDispatch(MetaClass.java:686)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
at org.kohsuke.stapler.MetaClass$2.doDispatch(MetaClass.java:244)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:721)
at org.kohsuke.stapler.Stapler.service(Stapler.java:253)
at Jenkins Main ClassLoader//jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHolder.handle(ServletHolder.java:783)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1670)
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:200)
at PluginClassLoader for metrics//jenkins.metrics.impl.MetricsFilter.doFilter(MetricsFilter.java:125)
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:197)
at jenkins.util.HttpServletFilter$1.doFilter(HttpServletFilter.java:77)
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:197)
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:203)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at jenkins.ErrorAttributeFilter.doFilter(ErrorAttributeFilter.java:29)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:159)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at jenkins.security.csp.impl.CspFilter.doFilter(CspFilter.java:83)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:94)
at jenkins.security.AcegiSecurityExceptionFilter.doFilter(AcegiSecurityExceptionFilter.java:52)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:54)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:125)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:150)
at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:105)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:235)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:229)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:106)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:117)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:63)
at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
at hudson.security.ChainedServletFilter2.doFilter(ChainedServletFilter2.java:111)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:173)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at org.kohsuke.stapler.UncaughtExceptionFilter.doFilter(UncaughtExceptionFilter.java:26)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:85)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:31)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:38)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doHandle(ServletHandler.java:526)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:125)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.security.SecurityHandler.handle(SecurityHandler.java:574)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HandlerWrapper.handle(HandlerWrapper.java:124)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:195)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doHandle(SessionHandler.java:612)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:193)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doHandle(ContextHandler.java:1047)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:162)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doScope(ServletHandler.java:483)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doScope(SessionHandler.java:589)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doScope(ContextHandler.java:962)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:123)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.handle(ContextHandler.java:1731)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1586)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.dispatch(HttpChannel.java:737)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.handle(HttpChannel.java:520)
at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler$CoreContextHandler$CoreToNestedHandler.handle(ContextHandler.java:3059)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1226)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:621)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.Server.handle(Server.java:197)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:788)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420)
at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1809)
at Jenkins Main ClassLoader//org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
at Jenkins Main ClassLoader//org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:317)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1240)
at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
at java.base/java.lang.Thread.run(Thread.java:1583)
```

## Expected behavior

A read-only API request should not produce an exception or stacktrace.

## Suspected cause

`GitParameterDefinition.getAllValueItems()` is exported through the Jenkins API and directly calls `doFillValueItems()`. The CVE fix added a `Job.BUILD` permission check to `doFillValueItems()`. During serialization this check throws an exception for read-only users and Stapler logs the exception before continuing the response.

## Additional notes

In our deployment this regression causes gigabytes of log output per day instead of megabytes :/

We've used previous plugin version `462.vdcf3df2ed2ca_` with the exact same request and permissions and haven't experienced the reported behavior.

I'd also like to note that the [Security Advisory](https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3745) states:
> ...
> Git Parameter Plugin 462.463.v496a_59f698e5 requires Item/Build permission to populate the list of values for Git parameters.

As noted before the response without the Job/Build permission is missing the `GitParameterDefinition` entry within `parameterDefinitions` completely.
I interpret the advisory like the intention was to only strip the entries of the `values` field in the `allValueItems` object and not the whole `ParametersDefinitionProperty`, which would be different to the current behavior.