[cleanup][misc] Fix all javac warnings in main sources

[aahmed-se]

Motivation

./gradlew compileJava --warning-mode all emits 77 javac warnings across ten modules on a clean
master. Almost all of them are deprecations left behind by the Netty 4.2, Jetty 12.1, Guava 33 and
commons-lang3 3.20 upgrades:

Module	Warnings
pulsar-client-admin-original	30
pulsar-client-v5	17
pulsar-broker	10
pulsar-testclient	5
pulsar-client-original	4
pulsar-proxy	4
pulsar-client-api	3
pulsar-websocket	2
pulsar-common	1
pulsar-package-core	1

Two reasons to clean this up now rather than later:

1. One warning is a latent break, not just noise. Jetty deprecated
   Session.Listener.onWebSocketClose(int, String) for removal
   (@Deprecated(since = "12.1.0", forRemoval = true)). AbstractWebSocketHandler still overrides it,
   so the WebSocket proxy stops receiving close callbacks the moment Jetty drops the method.
2. The volume hides new warnings. 52 of the 77 are the same repeated
   unknown enum constant RequiredMode.REQUIRED message, which drowns out anything genuinely new
   appearing in a PR's build log.

Modifications

1. Deprecated APIs moved to their documented successors. Each of these was checked against the
dependency's own sources rather than assumed:

• CacheBuilder.expireAfterAccess/Write(long, TimeUnit) → the Duration overloads, in the 7 caches in
  NamespaceName, PackageName, PulsarClientImpl, AbstractMultiVersionReader,
  MultiVersionSchemaInfoProvider, ConsumerHandler and SimpleLoadManagerImpl.
• PlatformDependent.threadLocalRandom() → ThreadLocalRandom.current() in
  PulsarServiceNameResolver. Netty's deprecated method body is literally
  return ThreadLocalRandom.current();.
• ChannelOption.RCVBUF_ALLOCATOR → RECVBUF_ALLOCATOR in BrokerService and ProxyService
  (4 call sites). A pure rename — Netty declares the deprecated field as = RECVBUF_ALLOCATOR, the
  same object.
• MutableObject.getValue() → get() in SystemTopicBasedTopicPoliciesService.
• The deprecated 5-arg PersistentSubscription constructor → the 4-arg one, in PersistentTopic.
  The 5-arg version ignores subscriptionProperties entirely (the cursor already carries them), so
  this is behaviour-identical. createPersistentSubscription keeps its signature because
  BrokerTestInterceptor overrides it; its javadoc now records that the parameter is unused.
• Jetty's onWebSocketClose(int, String) → onWebSocketClose(int, String, Callback) in
  AbstractWebSocketHandler, completing the callback. The old override had to be removed rather
  than kept alongside the new one: JettyWebSocketFrameHandlerFactory throws
  InvalidWebSocketException("Cannot use two versions of onWebSocketClose") for an endpoint that
  declares both. Its isOverridden check keys on getDeclaringClass() != Session.Listener.class, so
  the inherited default is correctly ignored once ours is gone.
• Removed the EpollChannelOption.EPOLL_MODE call in DirectProxyHandler. Netty 4.2 documents both
  the option and the EpollMode enum as no-ops ("Netty always uses level-triggered mode and so this
  method is just a no-op"), and level-triggered is exactly what zero-copy splice requires — so the
  guarded block was dead code. The proxyZeroCopyModeEnabled splice path itself is untouched.

2. One unchecked-generics fix. ScalableTopicController.prunable built a
CompletableFuture<Boolean>[] from a stream, which is an unchecked array creation. It now collects
into a List and keeps the same short-circuiting drain check.

3. Narrow suppressions where no successor API exists — placed at the declaration, each with a
comment giving the reason:

• intercept(...) in ProducerBuilder / ConsumerBuilder / ReaderBuilder: @SafeVarargs is
  illegal on an abstract method, so the heap-pollution warning is suppressed on the interface
  declaration. The implementations (ConsumerBuilderImpl, ReaderBuilderImpl) already carry
  @SafeVarargs on their final overrides.
• The v5 AuthenticationAdapter bridge must call v4's deprecated host-less getAuthData() in order to
  implement v5's host-less authData(); there is no non-deprecated v4 equivalent without a broker
  host.
• The three TopicPoliciesService.registerListener overrides
  (SystemTopicBased, MetadataStore, LegacyAware) are now @Deprecated themselves, matching the
  interface method they implement.

4. compileOnly(swagger-annotations) added to three modules — this is the 52-warning group.
pulsar-client's configuration-data classes (ClientConfigurationData and friends) carry
runtime-retained @Schema(requiredMode = REQUIRED) annotations. pulsar-client-admin,
pulsar-client-v5 and pulsar-testclient compile against those class files without the annotation
types on their compile classpath, so javac can't resolve the enum constant. Six other modules
(pulsar-broker, pulsar-common, pulsar-client, pulsar-proxy, pulsar-websocket,
pulsar-client-tools) already declare it exactly this way; this just extends the existing convention.

No production code behaviour is intended to change anywhere in this PR.

Compatibility note: AbstractWebSocketHandler.onWebSocketClose changes signature. That class is
public in pulsar-websocket, so an out-of-tree subclass overriding the 2-arg form would need the
same one-line migration — but Jetty forces this move regardless, and the method being overridden is
Jetty's listener callback rather than a Pulsar API. I have not ticked The public API below for this
reason; happy to reclassify if a reviewer sees it differently.

Verifying this change

• Make sure that the change passes the CI checks.

(Please pick either of the following options)

This change is already covered by existing tests, such as:

• ProxyPublishConsumeTest (18 tests) — the end-to-end WebSocket path against a real Jetty
  server. This is the important one: it exercises endpoint registration (which is where a botched
  onWebSocketClose migration throws InvalidWebSocketException) and real session closes.
• The full pulsar-websocket suite (33 tests), including AbstractWebSocketHandlerTest, whose
  direct onWebSocketClose call was updated to pass Callback.NOOP.
• NamespaceNameTest, PackageNameTest, PulsarServiceNameResolverTest (29 tests) — the Guava
  Duration and ThreadLocalRandom changes.
• PersistentSubscriptionTest, CreateSubscriptionTest, ScalableTopicControllerTest,
  SimpleLoadManagerImplTest, ProxyTest, ProxyDisableZeroCopyTest (90 tests) — the
  PersistentSubscription constructor, the prunable rewrite, the load-manager cache and the Netty
  channel-option renames.
• SystemTopicBasedTopicPoliciesServiceTest, LegacyAwareTopicPoliciesServiceTest,
  TopicPoliciesServiceDisableTest, InmemoryTopicPoliciesServiceServiceTest (27 tests) — the
  MutableObject.get() change sits on the namespace-cleanup path these cover.

197 tests total, 0 failures and 0 errors. No new tests were added: every change is either a
like-for-like API swap or annotation-only, so there is no new behaviour to cover.

Build verification:

• ./gradlew compileJava --rerun-tasks --warning-mode all → BUILD SUCCESSFUL with zero warnings
  (was 77).
• ./gradlew sanityCheck → passes (license headers, checkstyle, and main and test compilation for
  every module).

Two things a reviewer should know:

• The DirectProxyHandler change is not covered by a local test run. epoll is Linux-only, so
  proxyZeroCopyModeEnabled never engages on macOS and ProxyDisableZeroCopyTest only covers the
  disabled path. The removal rests on Netty 4.2's own javadoc marking the option a no-op. CI on Linux
  will exercise the zero-copy path.
• Test sources still emit warnings — roughly 197 across 14 compileTestJava tasks, mostly
  unchecked conversions in Mockito stubs, plus the same swagger classpath issue in pulsar-proxy's
  tests. Deliberately left out to keep this PR reviewable; happy to follow up separately.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

Dependencies: compileOnly(libs.swagger.annotations) is added to pulsar-client-admin,
pulsar-client-v5 and pulsar-testclient. Nothing is added or upgraded at the project level — the
artifact and its version already come from the version catalog and are already used by six other
modules. Because the scope is compileOnly, it reaches neither the runtime classpath nor the
published artifacts: I regenerated all three POMs with generatePomFileForMavenPublication and
confirmed swagger appears zero times in each. No distribution contents or LICENSE/NOTICE files
change. Flagged only because the diff touches build.gradle.kts files.