quarkus

The code is security API reference material with no evident malware. The primary security issue is the `InternalOnlyPolicy`, which grants authorization based solely on the client-controlled `X-Internal` header and can be bypassed unless deployment infrastructure guarantees that the header is trusted and protected. The authentication provider and mechanism snippets are incomplete placeholders and must not be used as actual authentication implementations without adding credential verification.