Keep a logged value from forging a debug record

[vharseko]

The java/log-injection cluster of the CodeQL medium triage (30 open alerts, plus the 5 dismissed earlier as "to be handled centrally"), handled centrally.

Where the logged values end up

• 26 of the alerts are SLF4J calls in the newer code (cassandra/Repo, ESIAProfileProvider, DefaultRealmLookup, IdTokenClaimGatherer). OpenAM ships its own SLF4J binding — openam-slf4j → AMDebugLogger → Debug — so every one of them is written by DebugFileImpl / StdDebugFile, the same two writers every Debug call in the product goes through. That is the one place to fix.
• 3 are the audit log (com.sun.identity.log.Logger, OpenSSOLogger). ELFFormatter.processString already writes \r, \n and " in every field as escapes; nothing to change.
• 2 are FedletLogger (the fedlet's JUL logger; the server uses LogProvider), 4 are the STS instance publishers logging the response body of the OpenAM server they publish to.

The debug record

A record is prefix\nmessage[\nstack trace], every line at column 0, so a line break carried in a logged value — a user name, a RelayState, a SAML attribute — started a line that read as a record of its own. DebugRecordFormat now lays out the record for both writers and for StdDebugFile.printError:

• a single-line message, the usual case, is written byte for byte as before;
• every line break inside a message (\r\n, \r, \n, U+0085, U+2028, U+2029) continues the record indented by four spaces, so a multi-line dump stays readable and nothing logged starts a line at column 0;
• every line of the stack trace is indented as well — an exception's own message is logged data too — and the trailing line break printStackTrace leaves is dropped (each trace used to be followed by a blank line).

A line at column 0 is a record's prefix and nothing else. This also makes the per-site forLog helpers that were being added to individual warnings unnecessary for the line-break part.

FedletLogger.formatMessage writes each parameter on a braced line of its own; a line break inside one is now written as \r / \n so it cannot leave the braces.

Verification

DebugRecordFormatTest (6) and FedletLoggerTest (3), each watched failing first. openam-shared 1243 tests (DebugTest, DebugRotationTest write through the real writers), openam-core 2130, openam-federation-library 180 — 0 failures.

Effect on the scan

CodeQL will keep reporting the 26 SLF4J sinks — the neutralisation happens below the sink, inside the binding — so after this lands they are dismissed with a reference to DebugRecordFormat, together with the 3 audit-log sinks (ELFFormatter) and the 4 STS publisher lines (a response body from the OpenAM server itself, logged in the STS process).