Unexpected JSESSIONID returned from Rest endpoints

[amasson88]

Describe the bug

Responses from a simple Jakarta Rest endpoint always contain a JSESSIONID cookie if server.xml contains

<feature>audit-1.0</feature>

...even if the endpoint implementation doesn't use HttpSession.
(Without audit-1.0, no JSESSIONID is returned as expected.)

Steps to Reproduce

Implement a simple Rest endpoint like

@RequestScoped
@Path("/testclass")
public class MyTestService {

    @GET
    @Path("/testmethod")
    public String myTest() throws Exception {
         return "SUCCESS";
    }
}

Ensure <feature>audit-1.0</feature> is in server.xml.

Call https://localhost:9445/testclass/testmethod, check response Cookies.

Expected behavior

The response should not contain a new JSESSIONIDcookie.

Diagnostic information:

• OpenLiberty Version: 24.0.0.9
• Affected feature(s): audit-1.0
• Java Version: semeru-21.0.4
• server.xml configuration

   <featureManager>
       <feature>microProfile-5.0</feature>
       <feature>transportSecurity-1.0</feature> 
       <feature>beanValidation-3.0</feature>
       <feature>socialLogin-1.0</feature>
       <feature>openidConnectClient-1.0</feature>
       <feature>audit-1.0</feature>
       <feature>jdbc-4.2</feature>
       <feature>persistence-3.0</feature>
       <feature>requestTiming-1.0</feature>
   </featureManager>

[una-tapa]

Found a possible cause in the following and a couple other places.

https://github.com/OpenLiberty/open-liberty/blob/integration/dev/com.ibm.ws.security.audit.source/src/com/ibm/ws/security/audit/source/utils/AuditUtils.java#L87

Planning to provide a test patch to @amasson88 for his feedback. Targeting sometime next week.