fix(java): resolve critical code review findings and hardening suggestions

[syniol]

Summary of Fixes

🔴 Critical Issues Addressed

1. ClientConfig Thread-Safety & Immutability:

   • Made ClientConfig final and converted all state fields to private final.
   • Removed public mutable setters (setApiKey, setApiBaseUrl, setConnectTimeoutMs, setRequestTimeoutMs, setMaxResponseBytes, setAllowInsecureHttp, setHttpClient).
   • Added ClientConfig.builder(), ClientConfig.builder(apiKey), ClientConfig.builder(apiKeySupplier), and toBuilder() for thread-safe instantiation and copying.
   • PII-redacted API key in ClientConfig.toString().

2. Resource Cleanup in XyoClient.close():

   • Implemented dynamic AutoCloseable inspection on HttpClient in XyoClient.close() to release selector threads, executors, and connection pools when running on Java 21+.

3. API Key Supplier Exception Wrapping:

   • Wrapped apiKeySupplier.get() in try-catch across XyoClient constructor, request interceptors, and binary download routes, converting unchecked supplier errors into XyoException with ErrorCategory.VALIDATION to prevent vault/secret credential leakage.

4. EnrichmentRequest.validate() Consistency & ISO 3166-1 Alpha-2:

   • Trimmed content before evaluating length limits (codePointCount <= 128).
   • Added strict isAlpha2 validation enforcing ISO 3166-1 alpha-2 format.
   • PII-redacted content=[REDACTED] in EnrichmentRequest.toString().
   • Guaranteed wire normalization (content.trim(), countryCode.trim().toUpperCase(Locale.ROOT)).

🟡 Hardening Suggestions Addressed

• Extracted duplicated CRLF injection checks to validateApiUser(String apiUser).
• Canonicalized overloaded client methods through RequestOptions.
• Added @Nullable annotations from JSpecify to XyoException, ClientConfig, and DTO getters.
• Added static factory methods to XyoException (validation, http, transport, parsing, rateLimit).
• Added toString() implementations to EnrichmentResponse and EnrichTransactionCollectionResponse.
• Enforced strict HTTPS for AWS S3 archive downloads even when allowInsecureHttp is enabled.
• Added comprehensive unit tests covering all fixes (49 tests passing).