feat(java): detect synchronous blocking remoting calls inside RunListener callbacks (CWE-400)

[ai-anant]

New rule in a new java/jenkins tree: detects a blocking, unbounded remoting call ($CH.call(...) on a channel) inside a RunListener onFinalized/onCompleted callback.

Why it matters: Jenkins listener callbacks execute on the build executor thread of the controller. A synchronous channel round-trip there has no timeout, so an unresponsive agent pins the executor indefinitely; repeated failures can exhaust every executor (controller-side DoS, CWE-400). The core performs agent probes asynchronously (callAsync + bounded future timeout on a dedicated thread) - the rule recommends mirroring that.

Rule id: codevigilant.java.jenkins.dos.runlistener.synchronous-call

• severity HIGH, confidence MEDIUM, metadata cwe/owasp/technology/references/license
• validated with semgrep 1.172 (semgrep --validate --config java/ clean)
• pos repro fires (1 match), neg repro (callAsync / local-only) does not
• 0 false positives across 30+ cloned Jenkins plugin sources