feat(java): detect unhardened DocumentBuilderFactory/TransformerFactory XML parsing (CWE-611)

[ai-anant]

Adds Jenkins-oriented Java rules for XML External Entity (XXE) processing:

1. codevigilant.java.jenkins.xxe.documentbuilderfactory-disallow-doctype-decl-missing
   Fires when DocumentBuilderFactory is used to parse XML (newDocumentBuilder() /
   newDocumentBuilder().parse(...)) without first disabling DOCTYPE declarations
   (setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)) or
   external entities (external-general-entities / external-parameter-entities).

2. codevigilant.java.jenkins.xxe.transformerfactory-dtds-not-disabled
   Fires when TransformerFactory.newTransformer() is called without restricting
   external DTD access (setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "") /
   ACCESS_EXTERNAL_STYLESHEET).

Why it matters: in Jenkins plugins these factories frequently parse XML derived from
network/service responses (SCM server output, webhook bodies, uploaded reports).
A malicious or compromised upstream service can inject a DOCTYPE with external
entities, giving the attacker a file-read / SSRF primitive in the Jenkins controller
JVM. The rules use pattern-not-inside on setFeature(...) / setAttribute(...)
so hardened factories are not flagged.

Validated with semgrep --validate; tested against a positive repro (unhardened
factories parsing a file - both rules fire) and a hardened negative (setFeature /
setAttribute present - no findings).