[#261] Format digests with java.util.HexFormat instead of JAXB

[vharseko]

openidm-script and openidm-maintenance use javax.xml.bind without declaring JAXB: ScriptRegistryService names inline scripts with DatatypeConverter.printHexBinary, and ChecksumFile formats checksums with HexBinaryAdapter.marshal. JAXB reaches them only through commons json-resource → api-descriptor, which OpenIdentityPlatform/commons#362 removes JAXB from.

Both calls now use HexFormat.of().withUpperCase(). The output keeps the upper case of the JAXB methods, so inline script names and the update checksums (including the checksum field of the update archive listing) do not change. These were the only uses of javax.xml.bind in the repository.

Tests

• ChecksumFileTest.testGetCurrentDigestIsUpperCaseHex (new) and ScriptRegistryServiceTest.testInlineScriptNameIsSha256OfSourceAndType compare against literals computed with md5 and shasum. The script test used to compute its expected value with HexFormat itself, which after this change would only compare the code with itself. Both tests pass on the base code, and both fail if withUpperCase() is dropped.
• With commons#362 simulated (managed exclusions of jaxb-api, jaxb-core and jaxb-impl on api-descriptor and json-web-token), the base fails to compile with package javax.xml.bind does not exist (ScriptRegistryService.java:39) and package javax.xml.bind.annotation.adapters does not exist (ChecksumFile.java:32). With this change both modules build and pass their tests (16 and 117) with and without the simulation.
• The generated Import-Package of both bundles differs from the base only by the removed javax.xml.bind;version="[2.3,3)" and javax.xml.bind.annotation.adapters;version="[2.3,3)".

Fixes #261

[maximthomas]

praise: The change replaces exactly the two JAXB call sites and keeps their output byte for byte.

• ChecksumFile.computeDigest (ChecksumFile.java:112) and ScriptRegistryService (ScriptRegistryService.java:608) were the only javax.xml.bind uses. In the rebuilt jars, Import-Package loses only javax.xml.bind;version="[2.3,3)" (openidm-script, 31 → 30) and javax.xml.bind.annotation.adapters;version="[2.3,3)" (openidm-maintenance, 25 → 24). Nothing else changes.
• ScriptRegistryServiceTest now asserts a literal SHA-256 instead of recomputing it with HexFormat, so the test no longer checks the code against itself. The new ChecksumFileTest.testGetCurrentDigestIsUpperCaseHex also passes against the base HexBinaryAdapter code (7/7), so it pins the unchanged upper-case output.
• With jaxb-api, jaxb-core and jaxb-impl excluded from api-descriptor 3.1.2, the base fails to compile at both imports. The head builds both modules with 16 and 117 tests green.