Migrate from Jackson 2.x to Jackson 3 (tools.jackson) (#430)

[wnm3]

Summary

Migrates JSONata4Java from com.fasterxml.jackson 2.x to tools.jackson 3.2.0 and cuts the major version to 3.0.0. Closes #430.

• Dependencies (pom.xml): switch to tools.jackson.core:jackson-databind and tools.jackson.dataformat:jackson-dataformat-xml 3.2.0; remove the Jackson 2.x jackson-databind and jackson-dataformat-xml blocks (woodstox-core retained); bump project version 2.6.4 → 3.0.0.
• Package/API renames across main + test: com.fasterxml.jackson.* → tools.jackson.*, TextNode → StringNode, JsonFactory → tools.jackson.core.json.JsonFactory, JsonProcessingException → JacksonException, JsonMappingException → DatabindException, immutable JsonMapper/XmlMapper builders.
• Version string bumped in README.md (×3) and the launch scripts tester.sh, testerui.sh, testerui.cmd.

Behavior-preserving fixes for Jackson 3 default/API changes

No test assertion or expected value was changed — every fix restores the Jackson 2 behavior at its source:

• MatchFunction/ReplaceFunction: guard the pattern emptiness checks so a POJONode-wrapped RegularExpression never reaches the now-throwing asText(); the boolean logic is identical to Jackson 2.
• ArrayUtils.compare: pass "" as the asText() default so container operands coerce to "" (Jackson 2 behavior) instead of throwing.
• AgnosticTestSuite: normalize whole-number doubles with (long) d, replicating Jackson 2's silent narrowing (Jackson 3's asLong() throws on out-of-long-range values).
• Utils test mapper: disable FAIL_ON_TRAILING_TOKENS to restore the Jackson 2 default so existing test inputs parse identically.
• catch (IOException) → catch (JacksonException) where Jackson 3 methods no longer throw checked IOException.

Documentation

• Added a "Retained Jackson 2 behaviors (as-built)" section to docs/specs/Jackson-3-Migration-Design.md recording each compatibility decision above (with how to reverse it if the project later adopts the stricter Jackson 3 semantics), plus the pre-existing Tester EOF NPE, the intentionally-tolerated "[\"h11\", \"h21\"]]" trailing-] test-data typo, and the acceptable transitive jackson-annotations dependency.
• Added explanatory comments at the MatchFunction/ReplaceFunction guard sites so the isTextual()-guarded emptiness checks are self-documenting.

Maven build-warning cleanup (unrelated to Jackson)

Fixed three pre-existing pom.xml warnings that appeared on every build:

• bnd private-reference (×2): added com.api.jsonata4java.expressions.regex to Export-Package — the exported com.api.jsonata4java / com.api.jsonata4java.expressions packages expose regex types (RegexEngine, RegexPattern, …) in their public API, so that sub-package must be exported too.
• additionalClasspathElements unknown (×2): removed the empty element from maven-compiler-plugin (not a valid parameter).
• excludes unknown: removed from the maven-assembly-plugin single goal (not a valid parameter; silently ignored — no effect on the produced jar).

A separate gpg.passphrase deprecation warning originates from the developer’s local ~/.m2/settings.xml, not this repo, and is resolved locally via gpg-agent.

Verification

• mvn clean test → BUILD SUCCESS, 1223 tests, 0 failures, 93 skipped.
• mvn package → builds JSONata4Java-3.0.0.jar; OSGi Import-Package header references only tools.jackson.* [3.2,4) (no com.fasterxml.jackson.*).
• dependency:tree shows only tools.jackson.*:3.2.0 plus the acceptable transitive jackson-annotations.
• Tester CLI evaluates end-to-end ($sort([3,1,2]) → [1,2,3]); XML round-trip smoke-tested via XmlMapper.builder().

Notes

• Pre-existing (unrelated to this migration) Tester REPL NullPointerException on stdin EOF at Tester.java:156 was left as-is (now recorded in the design spec's known-items section).

🤖 Generated with Claude Code

[wnm3]

Resolves Dependabot alert #7 (CVE-2026-54515 / GHSA-5jmj-h7xm-6q6v, jackson-databind, medium / CVSS 5.3).

The default branch's pom.xml is in a half-migrated state and still declares the vulnerable com.fasterxml.jackson.core:jackson-databind:2.22.0 (vulnerable range >= 2.22.0, < 2.22.1; patched in 2.22.1), which is what triggers the alert.

This PR removes the legacy com.fasterxml.jackson.core/dataformat databind entries entirely, leaving only tools.jackson:3.2.0. Since 3.2.0 > 3.1.4 (the 3.x patched version), the resolved dependency is beyond the fix and not in any vulnerable range — dependency:tree shows only tools.jackson.core:jackson-databind:3.2.0 / jackson-core:3.2.0. The one remaining com.fasterxml artifact is the transitive jackson-annotations:2.22, which is not affected by this advisory (it's a jackson-databind bug).

Merging this PR therefore clears alert #7. (Real-world exposure was already negligible: JSONata4Java parses JSON into a tree via readTree/JsonNode rather than doing POJO bean deserialization with @JsonIgnoreProperties + ACCEPT_CASE_INSENSITIVE_PROPERTIES, so the vulnerable code path isn't reachable through its API.)