Fix high-severity CodeQL alerts

[vharseko]

Fixes four of the six open high code scanning alerts.

Alert	Rule	Location	Change
#1	java/insufficient-key-size	JwtSessionManager.java	Temporary RSA key pair (used when no keystore is configured) is now generated with 2048 bits instead of 1024.
#3	java/zipslip	UiAdminHttpApplication.java	Extraction of openig-ui.jar moved into unpackJar(InputStream, File); an entry whose canonical path resolves outside the unpack directory now fails with IOException.
#5	java/sensitive-log	TypoglycemiaDetector.java	False positive on variable name: the logged value is a word from the scanned prompt, not a credential. Renamed token/tokens → word/words in scan().
#7	java/sensitive-log	TokenTransformationFilter.java	The trace log on cache hit no longer writes the issued STS token, only its length.

Tests added:

• JwtSessionManagerTest.shouldGenerateAtLeast2048BitKeyPairWhenNoKeystoreIsConfigured
• UiAdminHttpApplicationTest.shouldRejectJarEntryEscapingUnpackDirectory (jar with index.html followed by ../evil.txt) and shouldUnpackRegularJarEntryIntoUnpackDirectory

Not changed in this PR, to be dismissed in the code scanning UI:

• fix CVE-2019-10744 lodash #2 java/weak-cryptographic-algorithm in DesKeyGenHandler — Won't fix: the DES key is required for interop with OpenAM ReplayPasswd (password capture & replay), which uses SecretKeySpec(key, "DES").
• reorganize commons build artifacts #6 java/sensitive-log in TokenTransformationFilter.java:147 — False positive: the logged idToken is an Expression<String> whose toString() returns the expression template, not the evaluated token.