Play Framework

fix: security — JDBC statement leak, CSRF constant-time, path traversal, credential logging

Cherry-picked from worktree-agent-a9d52d4b (e9b56858f), with the following
applied:
- EvolutionQuery.java: wrap Statement in try-with-resources to fix leak
- WSAsync.java: remove Logger.trace line that logged keystore password
  when trace logging was enabled
- Controller.checkAuthenticity(): use MessageDigest.isEqual for the CSRF
  token comparison (constant-time, resists timing attacks) and add a
  null-check on the expected session token
- Router.java: fix path-traversal in static-file resolution — replace
  child.startsWith(root) with child.startsWith(root + File.separator)
  || child.equals(root), so e.g. \"/foo/barevil\" no longer passes the
  prefix check for \"/foo/bar\"

Deliberately not applied from the original commit:
- Crypto.java: the original added a PBKDF2 password-hashing implementation.
  v1.12.x already has its own AES/GCM + PBKDF2 + HMAC-SHA256 work from
  commits 652cd6b32 and 662251fbc, with a different API surface. Layering
  the worktree's PBKDF2 on top would either duplicate or partially
  conflict — kept HEAD's existing implementation. If specific behaviors
  from the worktree's Crypto.java are still wanted, they should be
  reconciled in a separate, focused commit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>