Reclassify the JAXP 1.5 accessExternal properties as modifiable

[ppkarwasz]

The securing is independent of the JAXP 1.5 external-access properties (accessExternalDTD, accessExternalSchema, accessExternalStylesheet): by specification, a resource supplied by a registered resolver bypasses their checks, and the resolver floor covers every external reference. No value a caller sets loosens the securing, and no value is needed to keep it — the known JDK defects that apply the checks even to resolver-supplied documents all fail closed.

This change therefore:

• moves the three properties from the reserved list to Settings you may modify in the threat model, including their system-property counterparts;
• adds a Javadoc overview section explaining why the securing builds on resolver floors rather than on these properties (resolver precedence, the XInclude gap they cannot cover, and the fail-closed JDK defects);
• adds AccessExternalPropertyTest, which loosens each property to all on a secured factory and asserts the external fetch still does not happen, across DOM, SAX, schema compilation and TrAX;
• extends AttackTestSupport with caller-configured-factory overloads of the existing no-leak assertions, and fixes a few Thesecuring typos in the threat model.

Tests pass across the full surefire implementation matrix; implementations that reject the properties (no knob to loosen) skip via assumptions.

🤖 Generated with Claude Code

https://claude.ai/code/session_014Hm8EbPnSdQeuQfsoFwQt1