Block insecure HTTP URLs in FileUtil by default

[Copilot]

FileUtil.open() would silently fetch resources (including DataDictionaries) over plain HTTP, exposing the load path to MITM substitution attacks. Since DataDictionary is the primary consumer, a compromised dictionary could bypass all message validation.

Changes

• FileUtil: Before opening any http:// URL, checks system property quickfixj.fileutil.allowHttpUrls. If not true (default), logs a WARN and returns null — the caller will fail with a descriptive "could not find" error. If true, loads but still warns.
  • https://, file:, jar:, and classpath locations are unaffected.
• FileUtilTest: Updated testURLLocation to assert HTTP is blocked by default; added testHTTPUrlAllowedViaSystemProperty for the opt-in path.

Opt-in override

For deployments on trusted private networks that genuinely need plain HTTP:

-Dquickfixj.fileutil.allowHttpUrls=true