fix: expand wildcard imports (AvoidStarImport, 79 violations)

[arimu1]

Closes #90

Summary

Mechanically expands all import x.y.*; wildcard imports to explicit
imports (51 wildcard import lines across 35 files).

Per the issue's own stated resolution, two static wildcard imports are
kept as-is (idiomatic JUnit/Mockito style) and are now excluded from
AvoidStarImport via config/checkstyle/checkstyle.xml, so the check
reflects the intended scope going forward instead of silently ignoring
them:

• org.junit.jupiter.api.Assertions.* (22 sites)
• org.mockito.Mockito.* (6 sites)

org.mockito.ArgumentMatchers.* and java.lang.Math.* were not
called out in the issue as exceptions, so those were expanded like
everything else.

One dead wildcard import (io.github.open_policy_agent.opa.ast.builtin.impls.*
in CapabilitiesGenerator.java) was simply unused and removed rather
than expanded.

No reordering of unrelated imports, no reformatting of unrelated code
— only import lines and the one checkstyle config change.

Test plan

• ./gradlew compileJava compileTestJava — BUILD SUCCESSFUL
• ./gradlew checkstyleMain checkstyleTest — 0 AvoidStarImport /
  UnusedImports / RedundantImport violations (was 79
  AvoidStarImport violations before). Total checkstyle warning
  count: 514 (main) → 435 (branch), exactly the 79 removed
  star-import warnings, confirming no other checkstyle regressions.
• ./gradlew build — BUILD SUCCESSFUL (full build incl. tests, PMD)

[arimu1]

Fixed the one real defect I found on audit:

ArithmeticBuiltins.java:20 — import static java.lang.Math.random; was unused. The original java.lang.Math.* wildcard here only actually supplied abs (4 call sites), ceil (:125), floor (:170), and round (:147); there's no bare random() call anywhere in the file — rand.intn() uses a local java.util.Random random = new Random(seed) instead. checkstyle's UnusedImports can't catch this because it treats the local variable named random as satisfying the reference check on the import.

Manually audited the other 34 files this PR touches for the same shadow pattern (a newly-expanded static import matching a same-named local var/field with zero real call sites). Of those, 16 files actually contain any import static line; the rest have only regular type imports, which don't have this blind spot. Across the 16:

• getArg (8 builtin files) — real call sites in every one.
• abs/ceil/floor/round (ArithmeticBuiltins, TimeBuiltins) — real call sites (minus the random fix above).
• assertArgType (ObjectBuiltins) — real call sites.
• assertEquals/assertTrue (SprintfUtilTest), assertThat/assertThatThrownBy (RegoMapperTest) — real call sites.
• any/anyString/contains/eq (DiscoveryPluginTest, explicit Mockito matcher imports alongside the intended Assertions.*/Mockito.* wildcards) — real call sites.

No other unused statics found.

Style note considered, not changed: the expansion script hoisted several files' new import static lines into the first regular-import block rather than grouping them together (e.g. ArithmeticBuiltins.java originally had statics sandwiched between two ordinary-import blocks). No ImportOrder/CustomImportOrder checkstyle rule exists in this repo, so it's silent either way, and the messiness isn't even consistent across files (ObjectBuiltins.java, for instance, already groups its statics cleanly at the end). Regrouping all 16 files mechanically would add diff noise for a purely cosmetic, unenforced concern, so I left it — happy to do it if a reviewer wants it.

Local verification (./gradlew compileJava compileTestJava checkstyleMain checkstyleTest build): BUILD SUCCESSFUL, 2838 tests / 0 failures / 0 errors (unchanged from before this fix), 0 duplicate imports, 0 remaining wildcards beyond the 2 intended (Assertions.* ×22, Mockito.* ×6). The only checkstyle findings anywhere in the touched modules are 17 pre-existing MethodNameCheck warnings on ceil_f/round_f/floor_f/abs_f (severity warning, non-blocking, unrelated to this change) plus similar pre-existing warnings elsewhere — nothing new from this diff.

CI caveat: only the DCO check has run so far (mergeStateStatus: BLOCKED, awaiting maintainer approval to run workflows for a first-time contributor) — no upstream CI has actually compiled or tested this yet. The build/test output above is from my local run standing in for that; please don't read the green DCO check as green CI.

Commit is signed off (DCO) as arimu1 <19286898+arimu1@users.noreply.github.com>.

[sspaink]

Thanks!