fix: security hardening — XXE protection, class loading restrictions, dependency upgrades - #1

Summary

Security audit and hardening of the tiny-spring codebase. Fixes critical and medium-severity issues found during a full scan:

CRITICAL fixes:

1. XXE Injection — XmlBeanDefinitionReader (both src/ and src+/) now disables DOCTYPE declarations, external general/parameter entities, and XInclude processing. Previously, malicious XML could read local files, perform SSRF, or cause DoS via billion-laughs attacks.
2. Unrestricted Arbitrary Class Instantiation — BeanDefinition.setBeanClassName() now includes a denylist blocking dangerous classes (Runtime, ProcessBuilder, Thread, javax.naming.*, java.net.*, java.io.*, java.lang.reflect.Proxy). Previously, untrusted XML could trigger instantiation of any class on the classpath.

MEDIUM fixes:
3. Information Disclosure — Replaced e.printStackTrace() in BeanDefinition with a thrown IllegalArgumentException, preventing stack trace leakage to stderr.
4. Outdated Dependencies — Upgraded JUnit 4.7→4.13.2, aspectjweaver 1.6.11→1.9.22, cglib-nodep 2.1_3→3.3.0, Java source/target 1.6→1.8.

Not found (N/A for this library): No hardcoded secrets, SQL injection, CORS, HTTP endpoints, debug endpoints, or auth layers.

Review & Testing Checklist for Human

• Verify XXE protections are correct — confirm DocumentBuilderFactory features match OWASP recommendations
• Review the class denylist in BeanDefinition.setBeanClassName() — consider whether additional classes should be blocked or if an allowlist approach is more appropriate for your use case
• Run mvn compile to confirm compilation succeeds (note: 2 pre-existing test failures exist on Java 17 due to cglib module-system incompatibility and a missing field in test XML config — these are not caused by this PR)
• If you use custom bean classes from java.io.* or java.net.* packages, verify they are not unintentionally blocked by the new denylist

Notes

• The original code could not compile on Java 17 at all (source option 6 is no longer supported), so the Java 1.6→1.8 upgrade was required.
• The 2 pre-existing test failures (ApplicationContextTest.test and ApplicationContextTest.testPostBeanProcessor) exist on master and are unrelated to these changes — they stem from cglib's incompatibility with Java 17's module system and a NoSuchFieldException in the test XML config.
• aopalliance 1.0 was not upgraded because 1.0 is the only version ever released.

Link to Devin session: https://app.devin.ai/sessions/2f5ed20a86974f4d8016d4badc36861f
Requested by: @scoldfield