Remediate insecure auth/XML patterns and bump H2 to patched version

[Copilot]

This PR addresses the security remediation issue by removing common static-analysis findings in application code and updating a vulnerable direct dependency. Scope is intentionally narrow: auth/token generation, XML parsing hardening, and a single dependency version bump.

• Auth service hardening (WizardAuthService)

  • Replaced weak primitives:
    • Random → SecureRandom
    • MD5 → SHA-256
  • Standardized hashing input encoding to UTF-8.
  • Kept output format stable (hex hash, wizardId-token session token shape).

• XML import hardening (WizardImportResource)

  • Locked down DocumentBuilderFactory to prevent XXE/entity expansion attacks:
    • secure processing enabled
    • DOCTYPE disallowed
    • external entities/DTD/schema access disabled
    • XInclude and entity expansion disabled

• Vulnerable dependency remediation

  • Updated direct dependency: com.h2database:h2 from 2.2.224 to 2.3.232.

• Focused regression coverage

  • Added targeted tests for:
    • SHA-256 hash characteristics and token suffix format
    • successful XML import for valid payloads
    • rejection of DOCTYPE-based XML payloads

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");

This change was produced with Moderne CLI and Moderne Agent Tools (MCP), informed by Moderne Prethink context (dependencies, test gaps, project identity).

• Fixes Security Remediation #128

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.