chore: improve XXE attack prevention

[triceo]

Reported by Aikido earlier today.

[Copilot]

Pull request overview

This pull request enhances XXE (XML External Entity) attack prevention in the codebase by improving the security configuration of XML parsing components. The changes were triggered by a security report from Aikido.

Key changes:

• Extracted and centralized secure factory creation methods for XML processing components
• Strengthened DocumentBuilderFactory configuration to disallow DOCTYPE declarations entirely
• Consolidated security configurations for TransformerFactory, SchemaFactory, and Validator
• Modernized code with String.formatted(), var declarations, and record types

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
core/src/main/java/ai/timefold/solver/core/impl/io/jaxb/GenericJaxbIO.java	Added secure factory methods with XXE protections, refactored existing code to use them, modernized syntax
core/src/test/java/ai/timefold/solver/core/impl/io/jaxb/GenericJaxbIOTest.java	Updated test assertion to match new DOCTYPE disallowance error message
benchmark/src/main/java/ai/timefold/solver/benchmark/impl/xsd/XsdAggregator.java	Updated to use new secure factory methods from GenericJaxbIO, modernized syntax

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zepfred]

LGTM!

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate failed

Failed conditions
69.7% Coverage on New Code (required ≥ 70%)

See analysis details on SonarQube Cloud