Fix note-level CodeQL findings across core, oauth2 and doc

[vharseko]

Closes the 16 note-level code scanning alerts that are worth fixing (#10–#15, #32, #46–#53, #58). The remaining notes are either pure @Override/static cosmetics (separate PR after #176 lands) or by-design findings to be dismissed.

openig-oauth2 — OAuth2Session

Alert	Change
#32 missing-space-in-concatenation	"…ID token" + "could not be decoded" produced ID tokencould not be decoded in the server_error description.
#53 uncaught-number-format-exception	A string expires_in that is not a number now raises OAuth2ErrorException(E_SERVER_ERROR, "'expires_in' field value is not a number: …"), consistent with the sibling "neither a Number nor a String" branch, instead of a raw NumberFormatException.
#58 local-shadows-field	The merged token response local is renamed mergedResponse; its uses (extractIdToken, the constructor) are pointed at it. No behavior change — testStateRefreshed covers the merge semantics.

openig-core

Alert	Change
#48, #49 uncaught-number-format-exception	ICAPFilter: a non-numeric connect_timeout / read_timeout now fails with a JsonValueException that points at the field (/connect_timeout: Expecting a number of milliseconds, got: soon) instead of NumberFormatException: For input string: "soon".
#12 deprecated-call (Object.finalize)	LdapClient.finalize() removed: the class is a singleton (INSTANCE), so the finalizer never ran.
#11, #13 deprecated-call (Class.newInstance)	Heaplets, JsonValues: getDeclaredConstructor().newInstance(). In JsonValues an InvocationTargetException is unwrapped to the constructor's own exception; the other reflective failures are caught as ReflectiveOperationException.
#10 deprecated-call	OpenApiMockResponseHandler: responses.get(ApiResponses.DEFAULT).
#50 uncaught-number-format-exception	Principal: the org.openidentityplatform.openig.websocket.ttl property is parsed once at class load by ttlMillis(String); an invalid value logs a warning and falls back to 180 s instead of throwing on every websocket message. Semantic change: the property used to be re-read on every authorize() call, i.e. it could be changed at runtime with System.setProperty. I assumed that is not a supported use — say so if it is.
#46, #47 uncaught-number-format-exception	MockDataGenerator: latitude/longitude generated with FAKER.number().randomDouble(6, …) instead of parsing a locale-formatted string.

openig-doc — SampleApplication

Alert	Change
#14, #15 deprecated-call	validateConfiguration(true) + createSSLContext() → createSSLContext(true), catching SSLContextConfigurator.GenericStoreException (what Grizzly 4.0.2 throws when the configuration is invalid). Exercised by the openig-doc integration tests, which start the sample with HTTPS.
#51, #52 uncaught-number-format-exception	A non-numeric port argument prints Port numbers must be integers: … plus the usage and exits, instead of a stack trace.

Tests

• OAuth2SessionTest: shouldStateAuthorizedWithNonNumericExpiresInFailWithOAuth2Error (failed before with NumberFormatException: For input string: "soon") and shouldStateAuthorizedWithUndecodableIdTokenFailWithReadableMessage (failed before with ID tokencould).
• ICAPFilterTest (new): timeouts are applied; a non-numeric connect_timeout / read_timeout (data provider) fails with a JsonValueException naming the field — failed before with a bare NumberFormatException.
• PrincipalTest (new): ttlMillis — seconds to millis, trimming, and the fallback for null / empty / non-numeric values.

Verified: openig-core 1007 tests, openig-oauth2 160, openig-doc 10 integration tests (HTTPS start included), javadoc with failOnWarnings.

Note for merging: Heaplets.java and Principal.java are also touched by #173 and #177 on different lines; the only shared line is the identical Portions Copyright 2026 header line.