Fixed arbitrary file write in TBEL script sandbox

[zzzeebra]

Summary

• Block java.util.Formatter in SandboxedClassLoader via a new forbiddenClasses exact-match denylist
• Add a test verifying the sandbox blocks java.util.Formatter
• Bump version 1.2.10 → 1.2.11

Problem

The allowedPackages entry "java.util" uses startsWith prefix matching, which permits every top-level java.util class. java.util.Formatter has a Formatter(String fileName) constructor that opens the named file for writing, so a Tenant Admin can write arbitrary content to an arbitrary path from a TBEL script:

new java.util.Formatter("/path/of/attackers/choosing").format("...", 1337).close()

Fix

Add java.util.Formatter to a forbiddenClasses set that is checked first in classNameAllowed, so the denylist wins over the java.util package allow and the class can no longer be loaded. This follows the existing forbidden-list pattern; the escape now fails at class resolution with could not resolve class: java.util.Formatter, identical to the blocked subpackages.

Test plan

Automated test in TbExpressionsTest:

• testForbiddenFormatterFileWrite — verifies new java.util.Formatter(...) is blocked and no file is created.

All 98 tests in TbExpressionsTest pass (legitimate java.util collections are unaffected).