chore: Improve Aviator FPR parsing and SSC preflight checks

[kireetivar]

This PR reduces repeated work and memory use during FPR parsing. It also reduces SSC requests before a SAST audit.

Target branch: dev/v3.x.

Changes

FPR parsing

• Convert each vulnerability during the second XML pass. Do not keep a second list of all raw vulnerabilities.
• Compile each description template once. Use the compiled template with the values for each issue.
• Reuse equal description text and equal knowledge maps.
• Reuse source lines, source fragments, and converted nodes where the parser can share them.
• Stop caching inline trace nodes that are not part of the shared node pool.
• Reuse repeated trace strings.
• Use a bounded cache for description cleanup. The limits are 1,024 entries and 1,048,576 input and output characters combined.
• Do not capture a Java stack trace for the internal missing-replacement signal. Keep the existing description fallback.
• Remove forced garbage collection and diagnostic waits from memory tracking.
• Remove XML event debug messages. Put detailed node and memory messages at TRACE level.
• Remove unnecessary list and array copies.

Parser corrections

• Resolve Reason trace references to nodes declared later in the node pool.
• Read ExternalEntries fields in the streaming parser.
• Add tests for missing references, self-references, shared nodes, and issue-specific description values.

SSC checks before download

• When the command only needs to know if an issue exists, stop after the first eligible issue.
• Keep exact counts for --skip-if-exceeding-quota and --test-exceeding-quota.
• Use server counts only when the selector and suppression checks succeed. Otherwise, inspect the issue pages.
• Check suppression support in the same application version and filter-set scope. If there is no positive control, use pagination.
• Reject fractional, negative, overflowing, and inconsistent counts.
• Report an unavailable count without promising an FPR download.
• If the count is unknown, quota modes skip the audit or return QUOTA_UNKNOWN. They do not start an audit with an unverified count.

Performance

These changes remove repeated template parsing, object construction, source extraction, and XML logging.

For an ordinary audit, a candidate on the first page allows the presence check to finish after one issue-page request. Exact quota checks can use smaller count responses when the compatibility checks succeed. Pagination remains necessary when those checks fail.

A speed increase for the complete parse or audit has not been measured in a controlled comparison. Peak-heap savings for the full branch have not been measured. The parser still keeps the final vulnerability list.

Tests

Passed on commit 26ba394441:

• Aviator Common: 352 tests.
• Aviator: 239 tests.
• Total: 591 tests, with no failures, errors, or skipped tests.

Command:

.\gradlew.bat :fcli-core:fcli-aviator-common:test :fcli-core:fcli-aviator:test -PautoFormat=false --offline --console=plain

The tests cover description output and cache limits, trace references, external entries, early exit, pagination, quota modes, and malformed SSC responses. Suppression tests cover both issue orders in normal and force modes.

This validation does not include a live SSC compatibility run or a native-image build.

Squash commit message

fix: `fcli aviator`: Reduce repeated work and object retention during FPR parsing
fix: `fcli aviator`: Resolve forward Reason trace references and parse ExternalEntries fields
fix: `fcli aviator ssc audit-sast`: Stop the presence check after the first eligible issue and validate counts for quota checks
fix: `fcli aviator ssc audit`: Use the same preflight and quota checks as audit-sast
fix: `fcli aviator ssc audit-sast`: Report unavailable counts and quota decisions accurately