Discuss safer alternative for SpEL string methods in DiscoveryClientRouteDefinitionLocator (Replacement for #4216)

As noted in PR #4246 and issue #4216, the removal of withInstanceMethods() from SimpleEvaluationContext in DiscoveryClientRouteDefinitionLocator breaks path predicates that rely on standard String methods like replaceFirst().

Since withInstanceMethods() was intentionally removed to prevent SpEL injection security vulnerabilities, we cannot simply restore it.

Proposal:
We need to discuss a safer enhancement to allow users to format or manipulate serviceId strings in their predicates.

Possible alternatives:

1. Provide a custom set of explicitly allowed SpEL functions (e.g. #replaceFirst(target, regex, replacement)) registered directly in the StandardEvaluationContext or SimpleEvaluationContext specifically for common string manipulations.
2. Introduce a new configuration property for DiscoveryLocatorProperties such as serviceIdRegex and serviceIdReplacement to natively handle regex substitutions during route definition generation without relying on SpEL evaluation at all.

Would love to hear the maintainers' thoughts on which approach would be preferred or if there are other secure ways to support this functionality.

Start by reading DiscoveryClientRouteDefinitionLocator and DiscoveryLocatorProperties, then review PR #4246 and issue #4216 for the security regression and existing use of String methods. Compare the proposed safe SpEL functions and configuration-property approaches without restoring withInstanceMethods(). Done means reaching a documented maintainer-approved design for secure serviceId manipulation.