Fix CodeQL note-severity alerts: deprecated JDK calls and inefficient expressions

[vharseko]

Third batch of note-severity code scanning fixes (after #814 and #817). Mechanical migration away from deprecated JDK/third party API plus the java/inefficient-* cleanups — about 135 alerts, no behaviour change intended.

Deprecated JDK and third party calls (88 of the 180 java/deprecated-call alerts)

• Class.newInstance() → getDeclaredConstructor().newInstance() (53) — deprecated since Java 9 because it silently propagates the checked exceptions thrown by the constructor. The call sites are the reflective component loaders (*ConfigManager, AbstractLogger, TaskScheduler, RecurringTask, SchemaHandler, makeldif TemplateFile, …); all of them already catch Exception, so the only structural change is in the quicksetup application loader, whose narrow catch clauses now also handle NoSuchMethodException and InvocationTargetException.

  Review follow-up: the new call wraps constructor failures in InvocationTargetException, whose toString() is just the class name, so the ten sites that formatted the caught exception with %s (both TemplateFiles, ExtendedOperationConfigManager, LogRetentionPolicyConfigManager, LogRotationPolicyConfigManager, AbstractLogger) now format it via getExceptionMessage()/stackTraceToSingleLineString() — both unwrap the InvocationTargetException — so the error message shows the real cause.

• X509Certificate.getSubjectDN()/getIssuerDN() → getSubjectX500Principal()/getIssuerX500Principal() (20) — the deprecated accessors return a Principal implemented by the internal sun.security API. Every call site either prints the DN, logs it, or uses it as a trust store alias; Platform.isSelfSigned() now compares the canonical X.500 forms, which is stricter than the previous Principal.equals().

• new Integer/Long/Byte(...) → valueOf(...) (8, SNMP), the Provider(String, double, String) constructor → the version-string one (1), JList.getSelectedValues() → getSelectedValuesList() (3, which also removes three @SuppressWarnings("deprecation")), JsonParser.getCurrentName() → currentName() (2), InputEvent.getModifiers() → getModifiersEx() (1).

Inefficient expressions and small defects (47)

• s.equals("") / "".equals(s) → s.isEmpty() — 30 of 35 alerts.
• new String("literal") → the literal (1); two keySet() iterations that immediately call map.get(key) → entrySet() iterations (3).
• java/call-to-object-tostring (3): LDIF.toLDIF() called toString() on the writer it had just written to and discarded the result — removed; ReturnCode gained a toString() so that it no longer logs as ReturnCode@1a2b3c; the replication trace logs the DN of the initialize task instead of its identity hash.
• java/inconsistent-javadoc-throws (2): removed two @throws tags for exceptions the methods cannot throw.

Alerts deliberately left open

• 92 java/deprecated-call on the server's own deprecated API (ObjectClass.isPlaceHolder 27, AttributeDescription.getNameOrOID 20, Entry.addAttribute/removeAttribute 23, DirectoryServer.getConfigEntry 9, AttributeDescription.create 7, …). That is an internal API migration, not a mechanical change, and belongs in its own work.
• Subject.getSubject() (1) — the replacement Subject.current() requires Java 18; this project targets Java 11.
• Five "".equals(x) tests (ConsoleApplication, LDIFChangeRecordReader, NewSchemaElementsTask, InstallDS, Installer) where the literal-first form is deliberately null safe and x.isEmpty() would throw.

Testing

• Full test suites: opendj-core 8173 tests, opendj-rest2ldap 531 tests, opendj-cli 46 tests — all passing.

• opendj-server-legacy (-Pprecommit), classes exercising server startup — which is what loads every component reflectively — plus groups, password policies, schema, tasks, makeldif and LDIF import/export: SchemaBackendTestCase (165), PasswordPolicyTestCase (144), TaskBackendTestCase (62), HostPortTest (37), LDAPURLTest (29), GroupManagerTestCase (25), LDIFBackendTestCase (22), MakeLDIFTestCase (17), TestBackupAndRestore (12), TestImportAndExport (12), SubentryPasswordPolicyTestCase (11), LDAPURLTestCase (8) — all passing.

  Four of these classes initially failed in setUp/startServer with IOException(Address already in use) while binding the administration connector to its fixed port; another OpenDJ test JVM was running concurrently on the same machine and holding ports 65534/65528. All four pass when re-run against a free port.

• After the review follow-up: both modules recompiled, EntryGeneratorTestCase (33) and TemplateTagTestCase (21) re-run — passing.

[maximthomas]

LGTM.

One thing worth fixing: getDeclaredConstructor().newInstance() wraps constructor failures, and InvocationTargetException.toString() is just the class name with a null message. Ten sites format the throwable with %s, so:

before: ...does not contain a valid extended operation handler implementation:
        java.lang.IllegalStateException: keystore file /opt/opendj/keys.p12 is unreadable
after:  ...does not contain a valid extended operation handler implementation:
        java.lang.reflect.InvocationTargetException

[vharseko]

@maximthomas Good catch, fixed in 9d5b399. Exactly ten sites formatted the caught exception with %s: the two TemplateFiles now format it via getExceptionMessage(e) and ExtendedOperationConfigManager, LogRetentionPolicyConfigManager, LogRotationPolicyConfigManager, AbstractLogger (two sites each) via stackTraceToSingleLineString(e) — the same helper their sibling config managers already use. Both helpers unwrap InvocationTargetException to its cause, so the message shows the real constructor failure again. The remaining migrated sites were already safe: they either use one of these two helpers, don't put the exception into the message at all, or attach it as the rethrown exception's cause.