Fix invalid XML characters in Surefire reports

[kush2439p]

Fixes #3399

What changed

• Sanitize invalid XML 1.0 code points in report attributes, text output, CDATA, and system properties.
• Preserve valid supplementary Unicode characters.
• Handle streamed UTF-8 output across write boundaries, including malformed sequences.
• Add regression coverage for invalid characters, chunk boundaries, CDATA, attributes, and report parsing.

Validation

• Focused StatelessXmlReporterTest: 13 tests passed.
• Compiler compilation passed.
• Checkstyle passed.
• git diff --check passed.

The full reactor test compile was not reliable in this Windows/JDK 25 environment because of a reactor classpath/forked compiler issue; the focused reporter suite passed.

Apache checklist

• Each commit in the pull request should have a meaningful subject line and body.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Run mvn clean install to make sure basic checks pass.
• You have run the integration tests successfully (mvn -Prun-its clean install).
• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004.