[#673] Fix ArrayIndexOutOfBoundsException on truncated percent-encoding in LDAP URLs

[vharseko]

Fixes #673.

Bug

A percent sign followed by fewer than two hexadecimal digits in an LDAP URL crashed with an uncaught runtime exception instead of producing a decode error. Reproducer from the issue:

Aci.decode(ByteString.valueOfUtf8(
    "(version 3.0; acl \":\"; allow (search) userdn=\"ldap://cn=name%B\"; )"), DN.rootDN());
// java.lang.ArrayIndexOutOfBoundsException at LDAPURL.urlDecode

Two instances of the same defect:

1. org.opends.server.types.LDAPURL.urlDecode — the bounds check if (i+2 > length) allows i+2 == length, so reading the second hex digit (stringBytes[++i]) overruns the array. Fixed to >= (as proposed in the issue). A truncated sequence now throws DirectoryException(INVALID_ATTRIBUTE_SYNTAX, ERR_LDAPURL_PERCENT_TOO_CLOSE_TO_END), which UserDN.decode already converts into a clean AciException.
2. org.forgerock.opendj.ldap.LDAPUrl.percentDecoder (SDK) — no bounds check at all: decoded.charAt(srcPos + 1/2) threw StringIndexOutOfBoundsException for "...%" / "...%B". Now throws LocalizedIllegalArgumentException(ERR_LDAPURL_INVALID_HEX_BYTE).

Tests

• LDAPURLTestCase (server) and LDAPUrlTestCase (SDK): truncated "%" / "%B" cases expect a clean decode error.
• New UserDNTestCase: the exact ACI reproducer from the issue expects AciException.

All three test classes pass locally (mvn -pl opendj-core test -Dtest=LDAPUrlTestCase; mvn -pl opendj-server-legacy verify -P precommit -Dit.test="LDAPURLTestCase,UserDNTestCase").