…uardJava-002)

Per cross-cutting decision D-001, the ignoreSsl feature is kept as a
legitimate convenience for development against self-signed appliances,
and the SDK does not emit a runtime warning. This commit closes the
documentation gap:

- README.md: new section 'TLS Certificate Verification and the
  ignoreSsl Flag'. Documents what ignoreSsl actually toggles (X.509 chain
  validation + a NoopHostnameVerifier, *not* the TLS version), a
  three-row table of supported configurations, and the recommended
  production paths (JVM truststore import, or a HostnameVerifier callback
  with ignoreSsl=false).
- RestClient.java: Javadoc on the (String, String, char[], boolean,
  HostnameVerifier) constructor describing the security implications of
  ignoreSsl and pointing to the TLS_PROTOCOL constant.
- SafeguardEventListener.java: equivalent Javadoc on the (String,
  char[], boolean, HostnameVerifier) constructor.

No code or public API changes.

Resolves F-SafeguardJava-001, F-SafeguardJava-002, F-SafeguardJava-004 (W3).

Add BoundedResponseReader that enforces a 10 MB default cap on in-memory HTTP response bodies. Pre-read check rejects oversized Content-Length headers; streaming counter trips on chunked overflow. Wired into Utils.getResponse and PkceAuthenticator.rstsFormPost. Explicit streaming download paths (StreamResponse, StreamingRequest) are unaffected — callers there manage their own sinks.

Audit outcome: Java event listener delegates reconnect to caller via SafeguardEventListenerDisconnectedException; no native tight-loop reconnect exists to harden. Distinct-but-valid design. A jittered exponential backoff helper is deferred to Phase 2.

…afeguardJava-001, D-014)

…sion

- Remove BoundedResponseReader and ResponseTooLargeException (not needed;
  Safeguard appliances are closed hardened systems)
- Revert Utils.getResponse and PkceAuthenticator to use EntityUtils
- Remove mockwebserver test dependency and response size cap test
- Remove handleDisconnect Phase-2 reconnect comment
- Strip internal finding IDs from test Javadoc
- Version 8.2.1-SNAPSHOT (patch bump, not minor)

The SignalR client dependency requires Java 9+ at runtime. All other
SDK features remain compatible with Java 8.