Fix Sonar S2259 potential NPEs to restore reliability rating (#231)

[AndreasIgel]

Summary

Fixes the two javabugs:S2259 ("access that may throw a NullPointerException") findings that push the SonarCloud new-code Reliability rating on main to C and fail the quality gate. Restores the reliability rating to A.

Fixes #231.

Changes

JavaLangMapper.isConcreteClass — real missing null-guard. Sonar's interprocedural flow (map → setEmptyConstructorInfoIfAvailable → isConcreteClass) shows typeElement may be null, so typeElement.getKind() could NPE. Guarded the parameter:

return typeElement != null
    && typeElement.getKind() == ElementKind.CLASS
    && !typeElement.getModifiers().contains(Modifier.ABSTRACT);

ImportCollector.collectImports — defensive guard for a Sonar dataflow false positive. GenerationTargetClassDto.generics is a final field initialised to new LinkedList<>() with no setter, so getGenerics() is never null; Sonar cannot prove that across the mapper. Assigned to a local and guarded:

List<GenericParameterDto> generics = classDef.getGenerics();
if (generics != null) {
  generics.forEach(generic -> generic.getUpperBounds().forEach(this::addTypeImports));
}

No behavior change.

Verification

• mvn -B install -Pmetrics --file pom.xml → BUILD SUCCESS, 311 processor tests pass (0 failures/errors), google-java-format clean.
• Generated-source gate clean: after rm -rf example/generated-example-builder && mvn -B -q -DskipTests -pl example clean compile, git status --porcelain -- example/generated-example-builder is empty.

Out of scope (tracked separately)

• githubactions:S7631 on fork-sonar.yml — security rating (analysis task Analyze fork-sonar.yml untrusted-fork-checkout finding (Sonar S7631) against existing fork-CI security gates #232).
• New-code duplication — accepted; to be resolved by extracting the shared model into its own project (Extract framework-agnostic builder/DTO model into its own project (resolves Sonar duplication gate) #233).

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
81.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud