Fix CodeQL note-severity alerts: dead parameters of private methods

[vharseko]

Addresses the java/unused-parameter alerts, the largest remaining group of note-severity code scanning alerts. They turned out not to be uniform noise: one of them was hiding a defect.

A dropped flag which leaked passwords into the printed command line

LDAPConnectionConsoleInteraction builds the "equivalent command line" the tools display. It has two entry points:

private void addObfuscatedArgToCommandBuilder(final Argument arg, final String value) {
    addArgToCommandBuilder(arg, value, true);
}

private void addArgToCommandBuilder(final Argument arg, final String value, final boolean obfuscated) {
    ...
    commandBuilder.addArgument(arg);        // the flag was never looked at
}

CommandBuilder has a dedicated addObfuscatedArgument() for values which must be masked, and the obfuscated entry point is used for --trustStorePassword and --keyStorePassword. Because the flag was dropped, those passwords were rendered in clear instead of ******. The flag is now honoured.

Dead code

CommonAudit.addJsonHandlerBufferingConfig() created an EventBufferingConfiguration and dropped it on the floor, ignoring both of its parameters. The OpenDJ configuration of a JSON audit handler carries no buffering settings at all — JsonConfigData only holds the log directory and the rotation/retention policies — so the method could never configure anything. It is removed together with its call, which also clears the java/local-variable-is-never-read alert on the same lines. Behaviour is unchanged: the handler keeps the library defaults it already used.

Dead parameters

Removed from the private methods of SchemaBuilder, Rest2LdapJsonConfigurator, DeleteIndexTask, ConfigFromConnection, ZipExtractor, ConfigureDS, LDAPAuthenticationHandler (two), StopDS and UpgradeCli, together with their @param javadoc; every call site is compiler-checked. The private BrowserController.notifyAuthDataChanged(url) overload was only ever called with null, so it is merged into the public method, keeping its TODO.

The four ACI enumerations (EnumEvalResult, EnumUserDNType, EnumEvalReason, EnumAuthMethod) passed a value to a constructor which discarded it; the parameter, the values of the 21 constants and the resulting empty constructors are removed. The javadoc of each constant already documents what the value meant.

Alerts deliberately left open

• ~127 are on interface declarations (InternalSearchListener), on the no-op default implementations of abstract classes (AccessLogPublisher.logSearchResultEntry — "The default implementation is to not log anything") and on public methods. There the parameter is part of a contract and cannot be dropped.
• 8 are private methods where removing the parameter would only move the alert one level up, onto the public method which passes it (ClickTooltipDisplayer.hideToolTip → mouseExited, FileTag/SequentialTag.initializeInternal → the parameters of the Tag interface, UpgradeCli.run → the public main), or where the parameter is needed: SubResourceImpl.adaptLdapException(Class<R>) uses it as a type witness, SASLContext.realmCallback() is a documented no-op callback handler, and LocalBackend.isIndexed() is a stub carrying a FIXME about being overridden by the backends.

Testing

• Full suites: opendj-core 8173 tests, opendj-config 547, opendj-rest2ldap 531, opendj-cli 46, opendj-server 3 — all passing.
• opendj-server-legacy (-Pprecommit), covering the ACI enumerations, the SASL handlers and the access log publisher: PlainSASLMechanismHandlerTestCase (67), IPTestCase (58), AbstractTextAccessLogPublisherTest (27), DigestMD5SASLMechanismHandlerTestCase (25), EnumRightTest (16), BindRuleOperandTest (13), ExternalSASLMechanismHandlerTestCase (13), AciBodyTest (8) — all passing. GetEffectiveRightsTestCase (7) passes as well; its first run had failed to bind the embedded server to the fixed administration connector port because another test JVM held it.