fix(cf-deploy-config-writer): align xs-security.json with CDS convention

[longieirl]

Summary

• Removes `xsappname` and `tenant-mode` from `xs-security.json` — these fields now live exclusively in the XSUAA resource `config:` block in `mta.yaml`, matching the output of `cds add mta`
• Standalone router `addUaa()` updated to use `${org}-${space}` variable pattern (consistent with managed/appfront router)
• `addTenant` parameter removed from `addXSSecurityConfig()` and `generateSupportingConfig()` as dead code
• Fixed broken imports in new `mta-deployment.ts` and `resource-manager.ts` files (stale `dirname`, misplaced `CloudFoundryServiceType`)
• Removed unused imports and refactored nested ternary in `mta-deployment.ts` and `router-configurator.ts` to resolve lint errors
• Updated `cf-deploy-config-sub-generator` fixtures to reflect new XSUAA config shape (`xsappname` uses `${org}-${space}`, adds `path` and `service-name`)

Closes #3080

Test plan

• All unit tests pass (`pnpm --filter @sap-ux/cf-deploy-config-writer test`)
• All `cf-deploy-config-sub-generator` tests pass (26/26)
• Snapshots and fixtures updated — `xs-security.json` no longer contains `xsappname`/`tenant-mode`; `mta.yaml` XSUAA config uses `${org}-${space}`
• Lint passes with 0 errors (`pnpm --filter @sap-ux/cf-deploy-config-writer lint`)
• Build passes (`pnpm --filter @sap-ux/cf-deploy-config-writer build`)
• Changeset included: `patch` bump for `@sap-ux/cf-deploy-config-writer`

[changeset-bot]

🦋 Changeset detected

Latest commit: f4e4f48

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@sap-ux/cf-deploy-config-writer	Patch
@sap-ux/cf-deploy-config-sub-generator	Patch
@sap-ux/deploy-config-sub-generator	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[longieirl]

Code review

Found 2 issues:

1. Missing snapshot updates in dependent packages — cf-deploy-config-sub-generator and deploy-config-sub-generator both depend on @sap-ux/cf-deploy-config-writer via workspace:* and have integration tests that read the generated xs-security.json and assert it via snapshots. Those snapshots still expect xsappname and tenant-mode fields that this PR removes from the template. Neither snapshot file was updated, so both test suites will fail in CI. A previous PR that made a smaller xs-security.json change (#3171) explicitly shipped snapshot updates and changesets for all three packages.

   Affected files:

   • open-ux-tools/packages/cf-deploy-config-sub-generator/test/__snapshots__/app.test.ts.snap

     Lines 324 to 328 in db65d58

     	"scopes": [],
     	"tenant-mode": "dedicated",
     	"xsappname": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
     	}
     	`;

   • open-ux-tools/packages/deploy-config-sub-generator/test/headless/__snapshots__/cf-headless.test.ts.snap

     Lines 157 to 161 in db65d58

     	"{
     	"xsappname": "managedAppCAPProjectJava",
     	"tenant-mode": "dedicated",
     	"description": "Security profile of called application",
     	"scopes": [],

2. addManagedUAAWithSecurity conditional leaves no fallback for xsappname/tenant-mode — The method only emits a config: block (with xsappname and tenant-mode) when both nodejs and com.sap.application.content:appfront modules are present. For other managed approuter scenarios, no config: block is added. Before this PR, xs-security.json served as a silent fallback since it contained those fields. After this PR removes them from the template, managed approuter scenarios that do not satisfy the condition end up with a XSUAA service that has neither xsappname nor tenant-mode configured anywhere.

   open-ux-tools/packages/cf-deploy-config-writer/src/mta-config/mta.ts

   Lines 401 to 414 in db65d58

   	path: './xs-security.json',
   	service: 'xsuaa',
   	'service-name': `${this.prefix?.slice(0, MAX_MTA_PREFIX_LENGTH)}-xsuaa-service`,
   	'service-plan': 'application',
   	...(this.modules.has('nodejs') && this.modules.has('com.sap.application.content:appfront')
   	? {
   	config: {
   	xsappname: `${this.prefix?.slice(0, MAX_MTA_PREFIX_LENGTH)}-\${org}-\${space}`,
   	'tenant-mode': 'dedicated'
   	}
   	}
   	: {})
   	}
   	};

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud