user story #3060002: Security: enforce use of pinned versions in bdd2…

[Noormasarwa]

Security: enforce pinned dependency versions + fix cross-platform feature path

Story: #3060002

What changed

1. pom.xml — Added maven-enforcer-plugin (3.5.0), bound to the validate phase, with two rules:
   • banDynamicVersions (allowSnapshots=false) — bans version ranges, LATEST, RELEASE, +, *, and SNAPSHOTs.
   • requireReleaseDeps — fails the build if any dependency resolves to a SNAPSHOT.
2. OctaneFeature.java — Normalized the path attribute written to the Octane result XML to forward slashes:

   writer.writeAttribute("path", featureFile == null ? null : featureFile.replace('\\', '/'));

Why

• Pinned versions: OpenText OSS policy requires all dependencies to use specific, fixed versions. This was previously enforced only at code-review level. Moving enforcement to the build level fails any non-compliant (dynamic/SNAPSHOT) version automatically. An audit confirmed all existing dependencies were already pinned, so no version replacements were needed.
• Path fix: The integration test Bdd2OctaneHandlerITCase (test36 - CUCUMBER_JVM) failed on Windows because the emitted path used the OS-native separator (\ on Windows vs / on Linux), causing a CompareXml mismatch against the fixtures and producing platform-dependent Octane output.

How it was implemented

• The enforcer execution runs early (validate), so a dynamic/SNAPSHOT dependency stops the build before compilation. The two rules map directly to the policy's required actions.
• The feature path is normalized to / at the single point where it is written to XML. On Linux paths are already /-based (no-op); on Windows \ is converted to /, yielding consistent, platform-independent output.

How it was tested

• mvn validate → both enforcer rules pass with current pinned dependencies.
• Injected a dynamic version range ([0.9,)) → build failed with a clear enforcer error, then reverted.
• mvn clean verify on Windows → BUILD SUCCESS, all 38 tests pass (0 failures, 0 errors). This same run previously failed on test36 - CUCUMBER_JVM.
• The path change is a no-op on Linux paths, so existing CI behavior is preserved.

[swar30]

use latest version https://mvnrepository.com/artifact/org.apache.maven.plugins/maven-enforcer-plugin/3.6.3

relevant changes removed from pull request