Play Framework

chore: remove MD5 password hashing, C3P0, and OAuth 1.0a (release 1.12.14)

Bundles three modernization-by-removal tickets that are safe to ship as a
single release because no consumer of this fork uses any of the removed
paths.

PF-21 (MD5 password hashing in Crypto):
- Removed the HashType enum, the orphaned DEFAULT_HASH_TYPE constant, and
  the legacy passwordHash(String, HashType) overload that allowed callers
  to opt back into MD5. The single-arg passwordHash(String) — already
  delegating to PBKDF2WithHmacSHA256 (260000 iterations, random 16-byte
  salt) — is now the only way to hash a password.
- Activated the dormant testPasswordHashPBKDF2RoundTrip test stub now
  that the PBKDF2 helpers it was waiting on are present. Suite runtime
  bumped from 0.146s to 0.293s, consistent with two real PBKDF2 calls
  doing their iteration work — also acts as a canary if iteration count
  is ever silently lowered.

PF-22 (C3P0 connection pool):
- Deleted the play.db.c3p0 package (C3P0DataSourceFactory and
  PlayConnectionCustomizer).
- Dropped c3p0, hibernate-c3p0, and mchange-commons-java from
  dependencies.yml; removed the matching jars (plus a stray
  c3p0-oracle-thin-extras-0.9.5.jar that was in lib/ but not even
  declared in dependencies.yml).
- DBPlugin.java: removed the c3p0 MLog adapter block and corrected the
  "Internal pool is c3p0" comment; HikariCP has been the default since
  Play 1.5.
- HikariDataSourceFactory.java: removed the long-standing dead
  if (db.isolation != null) TODO block and finally implemented
  db.isolation properly via HikariCP's setTransactionIsolation, with a
  small mapping (NONE -> TRANSACTION_NONE, etc.) for backward compat
  with apps configured against the old c3p0 short-name form.
- Logger.java: removed usesJuli() (sole caller was the c3p0 MLog block)
  and the com.mchange.v2.c3p0. stack-frame skip filter.
- log4j.properties: removed the logger.mchange entries.
- CLAUDE.md / AGENTS.md: dropped "/c3p0" from the db/ architecture line.
- configuration.textile: removed the C3P0DataSourceFactory entry from
  the db.factory list, deleted the 14 c3p0-only key sections, and
  rewrote the 5 retained pool-tuning sections to document HikariCP's
  real semantics — including correcting db.pool.unreturnedConnectionTimeout
  to milliseconds (HikariCP), not seconds (the c3p0 unit the docs had
  been claiming).

PF-23 (OAuth 1.0a):
- Deleted play.libs.OAuth.java (the OAuth 1.0a client).
- Dropped oauth.signpost -> signpost-core 1.2.1.2 from dependencies.yml
  and removed signpost-core-1.2.1.2.jar from lib/.
- WS.java: removed the OAuth.ServiceInfo import, the three oauthInfo /
  oauthToken / oauthSecret fields on WSRequest, and both oauth(...)
  methods on the WSRequest builder.
- WSAsync.java: removed 4 signpost imports + 1 OAuth.ServiceInfo
  import, all 6 sign() call sites in the HTTP-method overrides, the
  sign() method itself, and the WSOAuthConsumer + WSRequestAdapter
  inner classes (~90 lines).
- WSUrlFetch.java: removed 2 signpost imports and the
  OAuthConsumer.sign(connection) block.
- OAuth2.java: removed the now-stale "For OAuth 1.0a, see
  play.libs.OAuth" reference from the class Javadoc.
- libs.textile: removed the OAuth 1.0 bullet, deleted the entire OAuth
  1.0 narrative + Twitter sample-code section, and simplified the
  OAuth section so it describes only OAuth 2.0.

Net: -370 lines, no test regressions. ant compile clean, full
ant unittest BUILD SUCCESSFUL.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>