Replace deprecated API calls flagged by CodeQL

[vharseko]

Summary

Third note-level CodeQL batch: java/deprecated-call. 22 alerts replaced 1:1 with the current API, 5 dismissed with reasons; the 9 boxed-constructor ones (#60–#64, #69–#72) are already covered by #212.

Alerts	Replacement
#56, #59, #67, #68, #86 Class.newInstance()	getDeclaredConstructor().newInstance(); the specific catches in AuditServiceImpl / AuthenticationService widened to ReflectiveOperationException (the other three sites already caught Exception).
#87–#92 Jackson	MapperFeature.SORT_PROPERTIES_ALPHABETICALLY is applied through JsonMapper.builder() — configure/enable(MapperFeature) on a built ObjectMapper has been deprecated since 2.13. JsonUtil plus the five Activiti resources; the other features stay as they were.
#65, #66 OSGi LogEntry.getLevel()	getLogLevel() with a switch over the LogLevel enum. Minor behavioural improvement: AUDIT now logs at error and TRACE at trace instead of both falling into the "unknown level" warn branch.
#76, #77, #82, #83 ODocument.save()	db.save(doc) (the session is in scope at all four sites).
#78–#81 OrientDB index manager	getIndexManagerInternal() with the session-taking dropIndex(db, …) / getClassInvolvedIndexes(db, …).
#54, #55 commons-io FileUtils.write	The overload with an explicit StandardCharsets.UTF_8.
#58 X509Certificate.getSubjectDN() (log line)	getSubjectX500Principal().
#73 BoneCP setReleaseHelperThreads(5)	Removed — a no-op since BoneCP 0.8.

Dismissed:

• When the docker environment is running OpenIDM, the LDAP connector configuration cannot be saved #57 getSubjectDN().getName() — that string is the authenticationId existing deployments map client-certificate users by. X500Principal.getName() renders attributes outside RFC 1779 (EMAILADDRESS, UID, …) as OIDs, so switching would change the identity of existing users. Kept for compatibility.
• Add missing attachments & publish pdf to wiki #74, CVE-2024-47554 Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader #75 new ODatabaseDocumentTx(url) — retained by OrientDB 3.2 for compatibility; moving the pool/connection code to the OrientDB() / ODatabaseSession API (URL split into environment + database name) is a separate task for this legacy module.
• Fix missing workflow sample chess image #84, Bump org.openidentityplatform.openicf 1.7.2 #85 ASM visitMethodInsn — false positive: openidm-shell compiles against asm-all 3.3.1, where the 4-argument form is the only signature and is not deprecated (the 5-argument overload does not compile there). An ASM upgrade would be its own change.

Test plan

• Suites of the touched modules: audit 36, authnfilter 37, config 11, repo-jdbc 8, shell 8, repo-orientdb 31 (covers the save/index-manager changes), util 55, workflow-activiti 1 — 0 failures; httpcontext, servlet-registrator, custom-scripted-connector-bundler compile (no tests)
• CodeQL on this PR closes fix docs publish to wiki #54–Update README.md #56, [#57] Fix form2js issue #58, Deploy docs to https://doc.openidentityplatform.org/openidm #59, Fix provisioner component load #65–[#66] Activiti crashes (ClassNotFoundException: javax.script.ScriptEnineFactory not found) on default org.codehaus.groovy:groove-all:META-INF/services/javax.script.ScriptEngineFactory with comments inside it #68, Bump org.openidentityplatform.openicf 1.7.1 #73, Add JDK 23 build support #76–Fix doc push error #83, move sample chess image to local #86–Fix documentation issues and update links #92