Fix CodeQL warning-level Java correctness findings

[vharseko]

Summary

First of the warning-level CodeQL batches: the Java findings that touch correctness (null dereferences, resource leaks, switch coverage, equality, serialization). 18 alerts fixed here; #510 (ConnectorReference) was dismissed as a false positive (StringUtil.isBlank(null) handles the null before the dereference), and #515/#518 (AbstractScriptedService) are already fixed by #205.

Three of these are real bugs (bug below); the rest are cleanups that also remove the guards which misled the analysis.

Alerts	File	Change
#506–#508 dereferenced-value-may-be-null — bug	ObjectMapping	If a SynchronizationException was raised before op/event were created (e.g. bad params), the op != null && … guard meant it was neither logged nor rethrown, and setLogEntryMessage(null, se) then threw an NPE. Now op == null || op.action != EXCEPTION reports it like any other failure, and the audit block requires both op and event.
#516 dereferenced-value-may-be-null — bug	DateUtil.getDateDifferenceInDays	Integer result = null; … return result; unboxed to an NPE when either date was null. Now an explicit IllegalArgumentException, computed as int throughout.
#495/#496 missing-no-arg-constructor-on-serializable — bug	JsonUser, JsonGroup	Both are Serializable through Activiti's User/Group, but JsonValue has no no-arg constructor, so Java deserialization failed with InvalidClassException: no valid constructor. They now implement Externalizable (the JSON map is written/read); JsonUser.cryptoService is transient (it is an OSGi service — re-attach with setCryptoService). CodeQL keeps flagging the fixed classes (#926/#927): the query only looks for a no-arg constructor on the non-serializable super-class, while Externalizable deserialization uses the class's own public no-arg constructor — dismissed as a false positive.
#500–#502 input-resource-leak	SourceGenerator	Three unclosed BufferedReaders over classpath resources → one readResource() helper with try-with-resources.
#503 / #504 input/output-resource-leak	ConnectorInfoProviderService, JSONConfigInstaller	JarInputStream and FileOutputStream are now closed on every path, including the one where the JarInputStream constructor itself fails while parsing the manifest — the underlying FileInputStream is a resource of its own.
#469 non-short-circuit-evaluation	ManagedObjectSet	| → || in the name validation.
#489 reference-equality-on-strings	Link.targetEquals	In the null branch normalizedTargetId == normalizedCompId is just normalizedCompId == null; written that way.
#487 / #488 missing-case-in-switch	SyncOperation, RepoJobStore	default: for the inner action switch (only reachable for the outer cases) and for CUSTOM cluster events (debug log).
#505, #509, #511–#514, #517 dereferenced-value-may-be-null / useless-null-check	JSONConfigInstaller, SyncOperation, ConnectorUtil, ObjectClassResourceProvider, IdentityProviderService	Removed null checks on values that cannot be null (pid, sourceClass = source.getClass(), a final map field) and made the reauthCreds != null ↔ runAsAttributes correlation explicit.
#708 field-masks-super-field	ServiceTrackerNotifier	Dropped the context field that shadowed ServiceTracker's own protected final context.
#709 unsafe-get-resource	AuditServiceImpl	getClass().getResourceAsStream → AuditServiceImpl.class.getResourceAsStream.

Note: fix-codeql-error-alerts (#205) is merged into this branch, so the error-level java/missing-clone-method alert on JsonUser (master #491, re-reported here as #928 because this PR touches the class declaration) is fixed here as well. Its commits drop out of this diff as soon as #205 lands on master.

The four CodeQL alerts raised on this PR (#925–#928) are analysed and dispositioned in #220.

Test plan

• DateUtilTest +2 (missing start / end → IllegalArgumentException; failed with NPE before)
• New ActivitiIdentitySerializationTest — JsonUser and JsonGroup survive an ObjectOutputStream/ObjectInputStream round trip (failed with InvalidClassException / NotSerializableException before)
• New ConnectorInfoProviderServiceJarListingTest — listing a jar with a truncated manifest (the JarInputStream constructor fails) leaves no open file descriptor, measured through UnixOperatingSystemMXBean and skipped on Windows JVMs; before 5417702 it leaked one descriptor per call
• Suites of the touched modules: config 11, core 79, provisioner-openicf 136, util 61, quartz-fragment 8, workflow-activiti 3, audit 36, identity-provider 1 — 0 failures; custom-scripted-connector-bundler compiles (no tests)
• After the Fix CodeQL error-level findings: dead branches, log arguments, locking, clone #205 merge: mvn -pl openidm-workflow-activiti,openidm-provisioner-openicf -am test -Dtest=JsonUserTest,ActivitiIdentitySerializationTest — 4/4 pass (clone() and the serialization round trip), both modules recompile
• CodeQL on this PR closes the alerts listed in the commit message