Fix CodeQL warnings in the bundled scripts

[vharseko]

Summary

Third warning-level CodeQL batch: the JavaScript findings in the bundled server-side scripts (openidm-zip). 19 alerts fixed, 10 dismissed as false positives. The 7 alerts in policy.js (#768–#770, #782, #783, #895, #896) are deferred until #204, which rewrites part of that file, has landed.

Three real bugs (bug below); the rest are scoping fixes.

Alerts	File	Change
#759/#760 index-out-of-bounds — bug	router-authz.js	contains / containsIgnoreCase looped i <= a.length, reading the slot past the end. contains(list, undefined) and containsIgnoreCase([], undefined) therefore returned true. Now <. New routerAuthzTest.js evaluates the real script with stubbed host globals (the function declarations are hoisted, so they stay reachable after the trailing access check throws) — 8 cases, 2 failed before the fix.
#907 comparison-between-incompatible-types — bug	ui/correlateTreeToQueryFilter.js	typeof linkQualifier !== undefined is always true; now compares against "undefined". No behavioural change in real invocations: the sync engine (Correlation.java) and the admin UI always bind linkQualifier.
#785 use-before-declaration — bug	roles/effectiveAssignments.js	The effectiveRolesPropName = "effectiveRoles" default was applied after object[effectiveRolesPropName] had already been read, so without an explicit globals entry in managed.json the script read object[undefined]. The default now precedes the first use.
#771 missing-variable-declaration	audit/autoPurgeAuditRecon.js	Declared excludeMappings, used excludeMapping — typo.
#779/#780 missing-variable-declaration	roles/temporalConstraints.js	var constraintExpired = false; — the ; ended the declaration list, so dateUtil became a global.
#772–#778, #781, #784 missing-variable-declaration	policyFilter.js, defaultMapping.js, effectiveRoles.js, postOperation-roles.js ×4, relationshipHelper.js, samples/multiplepasswords/script/pwpolicy.js	Missing var.
#786 use-before-declaration	roles/defaultMapping.js	Two block-level var config = getConfig(…) were hoisted to script scope and overwrote the config binding (the mapping configuration) after it had been read; renamed to unassignmentConfig / assignmentConfig.
#787 use-before-declaration	samples/usecase/script/roles/effectiveRoles.js	Default expressed as var rolesPropName = rolesPropName === undefined ? "roles" : rolesPropName;.
#749 unreachable-statement	info/login.js	Dropped the return val after the if/else that always returns or throws.

Dismissed as false positives: #899–#906 useless-expression — the trailing bare expression is the Rhino idiom for a script's return value (a top-level return is a syntax error in a script); #893/#894 useless-assignment-to-local — source is read by the transform script evaluated through eval(p.transform.source) two lines later.

Test plan

• routerAuthzTest.js (new): contains(["a","b"], undefined) and containsIgnoreCase([], undefined) returned true before, false now; positive/negative cases pass
• mvn -pl openidm-zip -am package — ScriptRunnerTest green over all 9 JS test modules, including effectiveRolesTest, temporalConstraintsTest and conditionalRolesTest which exercise the edited role scripts
• CodeQL on this PR closes #749, #759, #760, #771–#781, #784–#787, #907