Don't enable GCM by default, even on Java >8?

What happened?

JRE-default GCM ciphers (even on Java >8) seem to cause a lot of heap churn. This ended up contributing heavily to a Horizon performance regression with Conjure enabled (2-3 sec operation -> 15-20 sec and about 10x more GC activity; see PDS-134017).

JRE version in use (from IL): zulu11.41.23-ca-jdk11.0.8-linux_x64

Example request load, 100 requests each 5MB in size with TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, tracking all allocations >100B in size:

Same request load, 100 5MB requests with TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, all allocations >100B:

Given this load seems to scale directly with network traffic, would expect this to generally cause more GCs in any server using GCM with nontrivial request or response sizes.

What did you want to happen?

Ideally, don't try to enable GCM by default if e.g. Conscrypt/Bouncycastle isn't in use.

Start by locating the Java TLS cipher-default configuration and the logic that detects Conscrypt or Bouncycastle. Reproduce the reported comparison with the stated Java 11 runtime and large request load, then verify that GCM is not enabled by default without those providers and that coverage reflects the intended provider behavior.