CVE-2024-8642: Eclipse Dataspace Components's ConsumerPullTransferTokenValidationApiController doesn't check for token validit

The vulnerability stems from ConsumerPullTransferTokenValidationApiController's token validation implementation. The controller calls TokenValidationService.validate(token, publicKeyResolver) without providing validation rules (third parameter), despite rules being registered for the 'dataplane-transfer' context. This omission prevents critical checks like token expiration from being executed. The removed code in commit 04899e9 confirms this was the vulnerable component, and the CVE description explicitly references this controller as the flawed implementation.