Close out the remaining small note-tier CodeQL categories

[vharseko]

Summary

Follow-up to the unused-parameter cleanup (#141): investigated all the newly-surfaced small note-severity CodeQL categories plus the 8 uncaught-number-format-exception alerts left over in AttributeTypeUtil.java after #139.

• GuardedString now overrides toString() (returns "GuardedString(...)"), so it no longer inherits Object's default. Fixes call-to-object-tostring at its root instead of patching the two current call sites (SharedSecretPrincipal, ScriptOnResourceApiOpTests) individually — any future logging of a GuardedString is safe by construction.
• AttributeTypeUtil.createInstantiatedObject: the 8 remaining uncaught-number-format-exception alerts. Numeric parsing now goes through private helpers that catch NumberFormatException and rethrow as ConnectorException with the offending value — the same pattern used across Wrap malformed numeric values in a domain exception instead of a bare NumberFormatException #139. Also swaps the deprecated boxed constructors (new Integer/Long/Double/Float/Boolean(String)) for their static parse methods.
• Removes the dead ContractTestFactory inner class from ContractITCase (unused-reference-type) and its now-unused imports.
• Mechanical, behavior-preserving fixes: StringUtil.isEmpty/XSDAnnotationParser empty-string checks (inefficient-empty-string-test), PrettyStringBuilder's Map iteration via entrySet() instead of keySet() (inefficient-key-set-iterator), a shadowed local in LdapInternalSearch.execute() (local-shadows-field), a javadoc @param typo/gap in MultiOpTests (unknown-javadoc-parameter), a missing space in a log message in ActiveDirectoryChangeLogSyncStrategy (missing-space-in-concatenation).

Also dismissed on GitHub: 3 ignored-error-status-of-call (the ignored return values are already covered by a subsequent check or exception path), 8 jdk-internal-api-access (AD DirSync's com.sun.jndi.ldap.Ber*, no public JDK alternative exists), 1 confusing-method-signature (Log.log(..) is long-standing, heavily-used public API — renaming to remove the overload is too invasive for the benefit).

Test plan

• New tests: GuardedStringTests.testToStringNeverExposesTheClearText, AttributeTypeUtilTests (valid values parse; malformed numeric values raise ConnectorException, not a bare NumberFormatException).
• mvn install on connector-framework, connector-framework-contract, OpenICF-ldap-connector, OpenICF-xml-connector (incl. their existing test suites, LDAP/OpenDJ integration tests included) — all green.