perf(crawler): reuse JAXP factories in XmlTransformer

[marevol]

Summary

XmlTransformer rebuilt heavyweight JAXP objects on every crawled document:

• transform() called DocumentBuilderFactory.newInstance() (JAXP service discovery) plus ~13 setFeature/setAttribute calls per document.
• getNodeList() built a brand-new XPathFactory + XPath for every field rule of every document — the pre-existing per-thread XPathAPI cache was never actually used for node selection.

This PR reuses those objects while keeping behavior and thread-safety intact.

Changes

• DocumentBuilderFactory: the configuration block is extracted verbatim into createDocumentBuilderFactory() and held in a per-thread ThreadLocal<DocumentBuilderFactory> initialized in init(). transform() now reuses the thread's configured factory and only calls newDocumentBuilder() per document (a builder is stateful). All security features/attributes (secure processing, external general/parameter entity disabling, external DTD/schema access) and parser options are applied with identical keys, values, and order.
• XPath: getNodeList() now goes through the existing per-thread XPathAPI cache via a new XPathAPI.selectNodeList(node, expression, namespaceContext), which reuses the thread's XPath instead of rebuilding XPathFactory/XPath per rule.

Design note: why compiled expressions are not cached across documents

A compiled XPathExpression freezes namespace-prefix resolution at compile time. XmlTransformer resolves prefixes with DefaultNamespaceContext, which walks the current document's own xmlns:* declarations — a genuinely per-document context. Caching a compiled expression by rule string alone would silently return wrong/empty results whenever two documents map the same prefix to different URIs. So selectNodeList deliberately rebinds the namespace context and recompiles per call; the win is eliminating the per-rule XPathFactory.newInstance() and the per-document factory reconfiguration, not expression compilation.

Thread-safety

All reuse is thread-confined: the DocumentBuilderFactory is a real per-Thread ThreadLocal, and the reused XPath comes from the XPathAPI cache keyed per crawler thread (the same pattern already used by the sibling HtmlXpathExtractor/HtmlExtractor). No JAXP object is shared across threads.

Testing

• New regression tests in XmlTransformerTest:
  • test_transform_sequentialDocuments — two different documents through the same transformer instance (then the first again), asserting exact output each time (guards against factory/state leakage).
  • test_transformNs_sequentialDocuments — a namespaced variant where the second document reuses the same prefix bound to a different namespace URI, specifically guarding the compile-time namespace-freeze pitfall.
  • test_transformNs_concurrentDocuments — 20 tasks over a 4-thread pool, each with a uniquely-namespaced document on a shared transformer instance.
• Full fess-crawler module test suite passes (1981 tests, 0 failures); mvn formatter:format / license:format / javadoc:jar all clean.

Relation to #175

Independent of #175 (the regex/hot-path quick-wins); this PR branches from master and touches a disjoint set of files.