fix: extension prefix collison

[buehner]

a potential fix for https://osgeo-org.atlassian.net/browse/GEOS-12131

[Copilot]

Pull request overview

This PR aims to prevent GeoServer extension install/download logic from selecting the wrong plugin archive when one extension name is a suffix of another (prefix-collision scenario), addressing GEOS-12131.

Changes:

• Adds _extension_filename_matches() to detect and reject extension-name prefix collisions by validating the inferred “version” segment.
• Applies the collision guard both during directory-listing-based filename discovery and during the install-time local file selection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

install-extensions.sh:143

• The new prefix-collision logic appears to have unbalanced if/fi blocks: the if [ -n "${FILE}" ]; then opened above is closed early, but there is still a later fi intended to close it, which will cause a Bash syntax error. Remove the extra fi so the guard wraps the new collision-check and the later fi closes it correctly.

            # Reject prefix collisions (GEOS-12131): the sed capture is greedy and
            # could pick e.g. "geoserver-3.0-SNAPSHOT-geofence-wps-plugin.zip" when
            # searching for extension "wps". _extension_filename_matches enforces
            # that the version segment is a plausible version.
            if [ -n "${FILE}" ] && ! _extension_filename_matches "${FILE}" "${EXTENSION}"; then