Pass only the required Kafka consumer properties to the spout lag monitor

[rzo1]

TopologySpoutLag copied every config.-prefixed key out of the submitted spout json_conf into the properties file handed to the storm-kafka-monitor process.

Only the properties the monitor actually reads are now forwarded, and anything dropped is logged by name so a lag display that stops working can be diagnosed. topics, groupid, bootstrap.servers and security.protocol are unaffected, since they travel via argv. Lag monitoring remains off by default. Adds TopologySpoutLagTest.

[reiabreu]

Disclaimer: this comment was generated with the help of an LLM.

Approving — the allowlist approach is sound (forwarding only connection-relevant consumer properties is safe by construction). One compatibility note worth calling out in the release notes: because topology-supplied config.* properties are now filtered, any lag-monitor setup that relied on a topology-provided sasl.jaas.config (or another now-dropped property) to authenticate to the brokers will stop reporting lag after upgrade, until the monitor is given its own credentials on the UI host. It's the correct behavior, just a silent change for those setups.