Remove Spring Core dependency from PDP engine

[ik8u]

This change removes the direct spring-core dependency from the PDP engine, reducing the engine’s dependency footprint and avoiding the inclusion of a general-purpose framework for a small set of utility functions.

Spring utilities were replaced with lightweight internal implementations while preserving the resource-location and placeholder-resolution behavior used by the PDP:

• Added ResourceLocationResolver supporting:

  • classpath: resources;
  • standard URLs, including file:, http:, and https:;
  • plain and relative filesystem paths;
  • safe rejection of non-file URLs when a physical File is required.

• Added PlaceholderResolver supporting:

  • ${property} expressions;
  • default values;
  • nested placeholders;
  • recursive value expansion;
  • circular-reference detection.

• Preserved system-property resolution with environment-variable fallback in PdpBean.

• Replaced Spring resource utility usage in PDP configuration, schema/catalog loading, static policy loading, test utilities, JSON/conformance tests, and the functional benchmark.

• Removed spring-core and the now-unnecessary jcl-over-slf4j dependency from pdp-engine.

• Updated Javadocs to describe the supported resource types without referring to Spring APIs.

Why

The PDP engine only used a small subset of Spring Core’s utility functionality. Keeping the full dependency increased the runtime dependency graph and exposed consumers to Spring version alignment and potential transitive dependency/security-management overhead.

The new internal utilities implement only the behavior required by AuthzForce, keeping the PDP engine framework-independent without changing its public resource-location formats.

Validation

The following checks were performed:

• Full reactor build and test suite:

  • mvn -q test package
  • Build successful
  • 1,682 tests executed
  • 0 failures
  • 0 errors
  • 2 skipped

• Dependency verification:

  • mvn -pl pdp-engine dependency:tree -Dincludes=org.springframework:spring-core -DskipTests
  • No spring-core dependency remains in the PDP engine dependency tree.

• Source verification:

  • No remaining Spring imports or Spring Core references in pdp-engine.

• Added/extended tests covering:

  • classpath resource resolution;
  • URL resolution;
  • relative filesystem paths;
  • missing classpath resources;
  • rejection of non-file URLs when resolving to File;
  • nested placeholders and recursive placeholder expansion.

Existing configuration loading, schema/catalog resolution, policy loading, CLI tests, XACML conformance tests, JSON tests, and test utilities all continue to pass.