[jonmille]

Summary

Fixes FIND-005 from the Java Client Security Findings Report (May 14, 2026),
tracked as MLE-30241.

OpenCSVBatcher.write() was creating a DocumentBuilderFactory via
DocumentBuilderFactory.newInstance() with no XXE mitigations, in contrast
to the rest of the library which consistently uses the hardened
XmlFactories.getDocumentBuilderFactory(). This provided an insecure
baseline to any developer who adapts or extends the example (CWE-611,
CVSS 6.1 Medium).

Changes

examples/.../OpenCSVBatcher.java

• Replaced DocumentBuilderFactory.newInstance() + two set* calls +
  newDocumentBuilder() with a single call to
  XmlFactories.getDocumentBuilderFactory().newDocumentBuilder()
• Updated imports: removed DocumentBuilderFactory, added XmlFactories

marklogic-client-api/.../OpenCSVBatcherTest.java

• Added documentBuilderShouldRejectDoctype() test verifying that the
  DocumentBuilder produced by XmlFactories.getDocumentBuilderFactory()
  throws SAXException on XML containing a DOCTYPE declaration, confirming
  XXE / DTD processing is disabled

Jira Bug: https://progresssoftware.atlassian.net/browse/MLE-30241