Feat/v3.x/aviator/remove legacy fvdl parsing

[anishkumarnagaraj-design]

Summary

This change removes legacy JAXB/DOM-based parsing code, eliminates JAXB dependencies that are no longer needed, and introduces a single entry point for SAST FPR parsing. There are no intended user-facing behavior changes.

Changes

1. Remove legacy DOM-based parsers (aee369e524)

• Deleted the unused FVDLProcessor and WebInspectParser. StreamingFVDLProcessor and StreamingWebInspectParser are now the only parsers in use.
• Deleted helper classes used exclusively by the legacy FVDLProcessor:
  • ReplacementParser
  • VulnerabilityMapper
  • NodeProcessor
  • TraceProcessor
  • SnippetProcessor
  • MetaInfoProcessor
  • AuxiliaryProcessor
• Deleted the generated fpr.jaxb classes (~18,000 lines across 100 classes) and the unused TraceEntry.
• Removed dead JAXB-based code from DescriptionProcessor, XmlUtils, and Entry.
• Updated StreamingWebInspectParserTest to validate XXE protection against the streaming parser only.
• Removed stale Javadoc and comments referencing the deleted classes.

2. Remove unused JAXB dependencies and native-image config (d43eaefbc0)

• Removed the following dependencies from fcli-aviator-common:
  • jakarta.xml.bind-api
  • jaxb-runtime
  • jakarta.activation
• Removed unused JAXB annotations from AuditResult, which is not marshalled through JAXB.
• Deleted obsolete native-image configuration files:
  • jaxb/reflect-config.json
  • jaxb/resource-config.json
  • grpc/proxy-config.json
• Kept this work in a separate commit to simplify rollback if native-image builds reveal unexpected issues.

3. Unify SAST FPR parsing (b4d21fd90e)

• Added SastFprParser.parse(fprHandle, sourceDecoder), which executes the shared parsing sequence:
  1. AuditProcessor
  2. StreamingFVDLProcessor
  3. FPRProcessor
  4. ParsedFprData
• Updated AuditFPR and AviatorSSCCorrelateFprParser to use the new shared parser instead of wiring processors individually.
• Removed outdated "DOM parser comparison" references from AviatorSSCCorrelateFprParser.
• Added SastFprParserTest to verify that the facade returns the same results as the previous manual processor wiring.

Acceptance Criteria

• AC1 (Legacy Removal): Complete. No production references to the removed DOM/JAXB parsers remain.
• AC2 (Unified Framework): Complete for SAST parsing. AuditFPR and the correlate command now share SastFprParser.
• AC3 (Compatibility): Existing parser tests (StreamingFVDLProcessorTest, FPRProcessorTest, StreamingWebInspectParserTest, and others) continue to pass unchanged. SastFprParserTest verifies parity with the previous implementation. Real-world FPR output comparison has not been performed.

Out of Scope

• RemediationProcessor continues to use StreamingFVDLProcessor directly because it loads build metadata rather than full vulnerability data.
• audit.xml DOM processing is unchanged because it requires reading and modifying XML rather than parsing FVDL content.
• DAST parsing was already standardized on a single streaming parser and is unaffected by this change.

Testing

Automated Tests

• :fcli-core:fcli-aviator-common:test
• :fcli-core:fcli-aviator:test
• :fcli-core:fcli-app:test

All pass locally.

Additional Verification

• After commit 2, the fcli-app runtime classpath contains no JAXB or jakarta.activation dependencies.
• No source code, build configuration, or native-image configuration files reference JAXB-related components.
• GraalVM native-image builds have not been verified locally. The native-image-* CI jobs will validate compatibility. The removed configuration files referenced JAXB classes that no longer exist.

[anishkumarnagaraj-design]

Sast audit regression

[anishkumarnagaraj-design]

tested with fcli.exe