Fix invalid XML characters in Surefire reports

[kush2439p]

Fixes #3399

What changed

• Sanitize invalid XML 1.0 code points in report attributes, text output, CDATA, and system properties.
• Preserve valid supplementary Unicode characters.
• Handle streamed UTF-8 output across write boundaries, including malformed sequences.
• Add regression coverage for invalid characters, chunk boundaries, CDATA, attributes, and report parsing.

Validation

• Focused StatelessXmlReporterTest: 13 tests passed.
• Compiler compilation passed.
• Checkstyle passed.
• git diff --check passed.

The full reactor test compile was not reliable in this Windows/JDK 25 environment because of a reactor classpath/forked compiler issue; the focused reporter suite passed.

Apache checklist

• Each commit in the pull request should have a meaningful subject line and body.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Run mvn clean install to make sure basic checks pass.
• You have run the integration tests successfully (mvn -Prun-its clean install).
• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004.

[Copilot]

Pull request overview

Sanitizes invalid XML 1.0 characters so Surefire reports remain parseable.

Changes:

• Sanitizes attributes, properties, stack traces, and output.
• Adds streaming UTF-8 validation and CDATA handling.
• Adds regression coverage for invalid characters and chunk boundaries.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
StatelessXmlReporter.java	Implements XML and UTF-8 sanitization.
StatelessXmlReporterTest.java	Tests report generation with invalid characters.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[kush2439p]

Addressed in f270ce7. Added a raw-byte regression test covering an invalid leading byte, an invalid continuation across writes, a valid four-byte sequence split across writes, and an incomplete sequence flushed by finish(). The test parses the resulting XML and asserts the exact U+FFFD replacements. Local verification: StatelessXmlReporterTest — 14 tests, 0 failures/errors/skips; Checkstyle, Spotless, RAT, enforcer, compilation, and the prerequisite reactor install also passed.

[kush2439p]

Hi maintainers, following up on this PR since it has not yet received a human review. The latest CI matrix is green and the XML-sanitization fix is ready for review. I am happy to rebase or address any feedback. Thank you.