Fix the warning-level CodeQL findings across the framework and connectors

[vharseko]

Closes 35 of the 37 open CodeQL alerts of severity warning without a security rating. Not in here: java/constant-comparison #1541 (ObjectPool, already fixed in #126) and java/unsafe-get-resource #1741 (ScriptedConfiguration.getClass().getResource(...): the default customizer path is built from getClass().getPackage() on purpose, so that a subclass ships its own CustomizerScript.groovy next to itself — to be dismissed as intended).

Real defects

• ADLdapUtil (dereferenced-value-may-be-null #1567 #1568): both GUID conversions swallowed the NamingException of attr.get() and then indexed the still-null array — the caller saw a NullPointerException with no clue about the LDAP error. They throw a ConnectorException carrying it now.
• AbstractRemoteConnection.convert (missing-case-in-switch #1538, #1562): no case for RequestType.API, so the method went on to call setHeader on a null request. default throws NotSupportedException.
• ObjectClassRunner.isObjectClassSupported (#1563): a contract test with no required operation iterated a null set; it now falls back to every object class of the schema.
• DocBookResourceMojo (output-resource-leak #1559): the FileWriter of the remote-resources manifest was never closed, i.e. not even reliably flushed. try-with-resources.
• OperationalContext.getConfiguration (unsafe-double-checked-locking-init-order #1553): the configuration bean was stored in the volatile field before its change callback was registered, so another thread could use it without the callback; it is built completely and published last.
• ScriptedConfiguration.getGroovyScriptEngine (#1552): the same pattern, but it can not be fixed by reordering — initializeCustomizer() → getCustomizerClass() → getGroovyScriptEngine() re-enters the getter, and the customizer script gets this. The getter is synchronized for the whole initialisation instead of double-checked, so other threads wait for the customizer rather than see the engine before it ran. Uncontended monitor, not a hot path.

Guards after the dereference / redundant guards

SchemaParser (type.getName() before if (type != null) — now a continue guard at the top, the block dedented; review with -w), AttributeTypeUtil (attrInfo.getType() before attrInfo != null), ObjectPool.borrowObject (if (null != rv) after rv.getPooledObject(); borrowObjectNoTest never returns null), MultiOpTests (coBeforeTest starts as an empty map), TstAbstractConnector (null-safe paged-results cookie), CSVFileConnector.generateSyncDelta (explicit IllegalArgumentException when both objects are null).

Housekeeping

• field-masks-super-field #1739 #1740: the OperationMessageListener queues of ICFWebSocket and OpenICFWebSocket shadowed the listeners fields of their superclasses; renamed to messageListeners (the WebSocketListener... constructor parameter is untouched).
• input-resource-leak #1557 / output-resource-leak #1558: IOUtil.getResourceAsString closes the reader (which closes the stream), IOUtil.writeFileUTF8 uses try-with-resources with StandardCharsets.UTF_8.
• non-sync-override #1548 #1547 #1783: getCause() overrides and CompletionListener.start() are synchronized like the methods they override.
• reference-equality-on-strings #1539: SQLParam.equals via Objects.equals.
• non-null-boxed-variable ×9: Boolean/Integer locals that never hold null are primitives (getColumnType never returns null — Types.NULL fallback).
• constant-comparison #1540 #1542 #1543: always-true conditions removed.

Tests

No new tests: the changes are dead conditions, types, monitors and ordering with no behaviour a test can observe, plus null paths unreachable with the current callers (the ADLdapUtil one needs an LDAP Attribute whose get() throws; can be added with a stub if wanted).

Local runs of all 13 touched modules, all green: framework 186, dbcommon 86, internal 469, contract 43, server 29, grizzly 34, csvfile 78, databasetable 43, groovy 125, ldap 159 (embedded OpenDJ), xml 81.

CSVFileConnector's header gets the same line #131 adds, so the two merge cleanly.