Fix duplicated allow lists upon script engine creation (#82820)

This fixes a bug where base allow lists were added to the merged context allow lists more than once 
in cases where getScriptEngine was called multiple times on the PainlessPlugin.

Closes #82778

docs/changelog/82820.yaml

@@ -0,0 +1,6 @@
+pr: 82820
+summary: Fix duplicated allow lists upon script engine creation
+area: Infra/Scripting
+type: bug
+issues:
+ - 82778

modules/lang-painless/src/main/java/org/elasticsearch/painless/PainlessPlugin.java

@@ -119,13 +119,12 @@ public final class PainlessPlugin extends Plugin implements ScriptPlugin, Extens
         Map<ScriptContext<?>, List<Whitelist>> contextsWithWhitelists = new HashMap<>();
         for (ScriptContext<?> context : contexts) {
             // we might have a context that only uses the base whitelists, so would not have been filled in by reloadSPI
+            List<Whitelist> mergedWhitelists = new ArrayList<>(BASE_WHITELISTS);
             List<Whitelist> contextWhitelists = whitelists.get(context);
-            if (contextWhitelists == null) {
-                contextWhitelists = new ArrayList<>(BASE_WHITELISTS);
-            } else {
-                contextWhitelists.addAll(BASE_WHITELISTS);
+            if (contextWhitelists != null) {
+                mergedWhitelists.addAll(contextWhitelists);
             }
-            contextsWithWhitelists.put(context, contextWhitelists);
+            contextsWithWhitelists.put(context, mergedWhitelists);
         }
         painlessScriptEngine.set(new PainlessScriptEngine(settings, contextsWithWhitelists));
         return painlessScriptEngine.get();