COMPRESS-721 -- avoid reflection when possible in unpack200

[tballison]

Thanks for your contribution to Apache Commons! Your help is appreciated!

Before you push a pull request, review this list:

• [*] Read the contribution guidelines for this project.
• [ *] Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
• [* ] I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
  Claude Opus 4.6 significantly
• [* ] Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
• [* ] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• [ *] Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

[tballison]

I added unit tests that fail when building without the ${argLine} --add-opens java.base/java.io=ALL-UNNAMED in the pom.xml

[garydgregory]

Hello @tballison

-1: These tests don't test anything new. They always pass, whether or not the changes to main are applied, inviting a regression to whatever you think you're fixing.

[tballison]

@garydgregory LOL...y, I added those when I was manually testing by removing the java >=17 profile in the pom.xml. However, as you point out, the build already fails spectacularly with existing tests when that is removed because of exactly this issue.

[tballison]

As a side note, the more aggressive fix is to get rid of reflection entirely. I chose to modify the existing code as little as possible on this PR, but happy to go bigger if desired.

[tballison]

Sorry for the noise, LegacyConstructorsTest obv still needs the java 17 profile. I confirmed we do not need new unit tests for pack200. The {{--add-opens}} which is necessary for existing unit tests masks the problems for unpack200.

[garydgregory]

Hello @tballison

There might be a way to do this without reflection, if so please provide it 😁 Otherwise, these untested changes are Just asking for a regression in the future...

[tballison]

fix incoming, again apologies for the noise.

[tballison]

@garydgregory this is the go bigger option with fully removing reflection. Pack200ModuleAccessTest fails when the fix is reverted.

[tballison]

K, I moved this to draft to do a bit more research. I think this is ready for review now.

My belief is that the band-length OOM guard added in a3474d1 (unpack200 hardening) makes the BoundedInputStream's Codec.check() tripwire redundant...checkIntArray runs whether or not the stream is bounded.

This means that we could remove the BoundedInputStream entirely, but that would touch more of the code and would be a bigger PR.

Let me know what you think.