Fix CodeQL note-severity alerts: the leftovers of the already-fixed rules

[vharseko]

The leftovers of the note-severity rules whose main batches are already merged: the sites which were skipped as marginal at the time, gathered here so those rules reach zero except where the alert is provably wrong or the fix is a refactoring of its own.

Sixteen alerts closed

• java/inefficient-empty-string-test (5) — "".equals(x) becomes x.isEmpty() in InstallDS, Installer, NewSchemaElementsTask, LDIFChangeRecordReader and ConsoleApplication. Each was already guarded against null on the line above or by the surrounding call.
• java/uncaught-number-format-exception (4) — ProductInformation read version.build, version.major, version.minor and version.point through Integer.valueOf(properties.getProperty(...)), so a bundle without them failed with NumberFormatException: null and no hint at what was wrong. They go through one intProperty() which reports the offending key and value as the MissingResourceException the rest of the class already throws when its bundle is unusable.
• java/local-variable-is-never-read (5) — TempLogFile assigned the publisher addPublisherIfRequired() had already registered, RemoteReplicationPortsPanel read a map key its loop does not use, and EndTransactionExtendedRequest decoded a message ID, a control list and each encoded control only to drop them. That decoder cannot do better today, and the comment now says why: getValue() writes each control as its value alone, without OID or criticality, so a Control cannot be rebuilt from the wire until both sides are completed together. The values are still read, because the reader has to consume them; they are simply no longer bound to names that suggest otherwise.
• java/ignored-error-status-of-call (1) — OnDiskMergeImporter.BufferPool fills an ArrayBlockingQueue sized for exactly the buffers it allocates, and ignored the result of offer(). add() says the refusal is impossible and throws if that ever stops being true.
• java/unknown-javadoc-parameter (1) — DeleteIndexTask.getConfigCommandLineName() documented an index parameter it does not take.

Nineteen alerts left, and why

Provably wrong (5). FixedTimeRotationPolicy parses time-of-day values, but the configuration definition constrains them with ^(([0-1][0-9])|([2][0-3]))([0-5][0-9])$, so what reaches Integer.valueOf() is always four digits. CtsAccessTokenResolver parses expireTime inside a promise chain which ends in thenCatchRuntimeException() and turns any NumberFormatException into an AccessTokenException carrying ERR_OAUTH2_CTS_TOKEN_RESOLUTION — no exception escapes. LDAPPassThroughAuthenticationPolicyFactory and LDAPConnectionFactory are reported for ignoring offer(), but both queues are ConcurrentLinkedQueue, which is unbounded and whose offer() always returns true.

A migration rather than a fix (14). The remaining java/deprecated-call alerts are calls into deprecated internal APIs whose replacements need a ServerContext threaded through the legacy configuration layer: DirectoryServer.getConfigEntry() (9, in the backends and the two configuration managers), ChangelogBackend.getInstance() (2), CoreConfigManager.isAllowAttributeNameExceptions() (2). Moving them belongs with the configuration-layer work, not with a cleanup pass. The last one, Subject.getSubject() in JMXMBean, cannot be fixed at all on this baseline: the replacement, Subject.current(), is Java 18 and up.

Testing

• opendj-core 8182 tests, opendj-cli 46, opendj-server 3 — all passing; they cover LDIFChangeRecordReader, ConsoleApplication and ProductInformation.
• opendj-server-legacy (-Pprecommit): the whole of org.opends.server.tools.** and org.opends.quicksetup.** together with Rfc5808TestCase, which drives the transaction extended operations whose decoder changed, and ImportLDIFTestCase, which exercises the on-disk merge importer — 448 tests, all passing.