Fix the SpotBugs findings and gate the build on SpotBugs (#116)

[bertysentry]

Closes #116.

SpotBugs 4.10.4 reported 196 bugs on main (the issue counted 227; DecoderRunner and a few others were already gone). It now reports 0, and spotbugs:check runs at verify, pinned to 4.10.4.1 in <build> and <reporting>. spotbugs-annotations 4.10.4 is a provided dependency.

Real fixes

Finding	Fix
NP_GUARANTEED_DEREF	ProtocolDecoder.decodePayload: an empty payload threw NullPointerException in the payload constructors; it now throws IllegalArgumentException("Empty payload")
DM_DEFAULT_ENCODING (RAKP, part of #90)	The user name and password are encoded in UTF-8 whatever the platform charset. The BMC key (Kg) goes to the HMAC as raw bytes instead of through new String(key).getBytes(), which corrupted any byte of 80h or above into a wrong SIK. The user name length and its 16-byte limit count encoded bytes. AuthenticationAlgorithm takes the key and password as byte[]
DM_DEFAULT_ENCODING (others)	SerialOverLan overloads documented as using the platform charset now pass Charset.defaultCharset(). ManagementAccessInfo decodes ISO-8859-1, like the other FRU 8-bit ASCII fields
AT_STALE_THREAD_WRITE_OF_PRIMITIVE, IS2_INCONSISTENT_SYNC (part of #96)	volatile on the fields shared by the caller, UDP and timer threads in Connection, MessageQueue and UdpMessenger. MessageListener writes its tag under its lock
JLM_JSR166_UTILCONCURRENT_MONITORENTER, USO_UNSAFE_STATIC_METHOD_SYNCHRONIZATION	ConnectionManager locks a dedicated object instead of an AtomicInteger. SessionManager uses an AtomicInteger instead of a static synchronized method
ST_WRITE_TO_STATIC_FROM_INSTANCE_METHOD, SSD_DO_NOT_USE_INSTANCE_LOCK_ON_SHARED_STATIC_DATA	Removed the unused static debug counter UdpMessenger.getSentPackets(). setBufferSize() now sizes the receive buffer, which was hard-coded to 512 bytes
OBL_UNSATISFIED_OBLIGATION (part of #98)	PropertiesManager closes its resource stream
BC_VACUOUS_INSTANCEOF, UC_USELESS_CONDITION, MS_PKGPROTECT	Removed the always-true instanceof in IpmiCommandCoder and the dead condition in ChassisInfo. CONST1/CONST2 are private

Justified suppressions

• core/package-info.java: CT_CONSTRUCTOR_THROW and EI_EXPOSE_REP for the whole protocol core. A package-level @SuppressFBWarnings also covers subpackages, and EI_EXPOSE_REP also matches EI_EXPOSE_REP2. Constructors reject invalid arguments and guard no security-sensitive state. Response data and records are mutable holders with public setters, so defensive copies would protect no invariant and add an allocation per packet.
• IpmiClientConfiguration: the password char[] and BMC key are shared deliberately, so the caller can wipe them.
• Fru, Sensor: result holders. PropertiesManager.getInstance(): singleton.

SpotBugs reports a suppression that matches nothing (US_USELESS_SUPPRESSION_*), so these can't go stale silently.

For reviewers

• Not done from the issue's suggestion: no defensive copies in *ResponseData and the FRU records, for the reason above. Easy to add if you prefer them.
• API changes, listed in upgrading.md: AuthenticationAlgorithm.getKeyExchangeAuthenticationCode(byte[], byte[]) and checkKeyExchangeAuthenticationCode(byte[], byte[], byte[]); UdpMessenger.getSentPackets() removed; CONST1/CONST2 private; decodePayload throws IllegalArgumentException on an empty payload.
• Behaviour: UTF-8 credentials only differ from before on JVMs whose default charset is not UTF-8 (Java 17 and earlier on Windows or with a C locale). A BMC key with high bytes now works.
• Still open: the rest of Credentials handling: BMC key / password / username go through String and the platform charset; char[] password converted to String in the client #90 (20-byte password limit, char[] end to end), Data races: handshake/state fields polled without volatile, listener lists iterated unsynchronized #96 (listener lists, polling) and PropertiesManager and connection.properties issues: dead cleaningFrequency, NPE on missing resource, unsynchronized lazy init, INFO log per lookup #98 (missing resource, lazy singleton) are left for their own PRs.
• Docs: AGENTS.md and README describe the gate and the suppression rule. configuration.md states the UTF-8 encoding.

Testing

• mvn verify site passes: 34 tests, 0 Checkstyle, PMD and CPD clean, SpotBugs 0.
• New Rakp1Test computes the SIK independently from IPMI 2.0 §13.31 with a high-byte Kg and a non-ASCII user name and password. It fails on the old code.
• Live, on a GIGABYTE BMC and a Lenovo IMM: login with cipher suites 3 and 17, then Get Chassis Status over the encrypted session. A wrong password is still rejected (Illegal connection state: Rakp1Waiting, as documented).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T12:50:06.269523Z	d0e7e6d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4e6d9ddff6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".