[#712] Fix StringIndexOutOfBoundsException on blank bind rule in ACI

[vharseko]

Fixes #712.

Bug

An ACI containing a blank bind rule (only whitespace between the parentheses) crashes Aci.decode with an uncaught java.lang.StringIndexOutOfBoundsException instead of being rejected with an AciException. Reproducer from the issue:

String input = "(version 3.0; acl \"C\"; allow (search)(          ) (userdn=\"ldap:///self\"); )";
Aci.decode(ByteString.valueOfUtf8(input), DN.rootDN());
// java.lang.StringIndexOutOfBoundsException at BindRule.decode(BindRule.java:154)

Root cause

BindRule.decode guards the empty input before trimming:

if (input == null || input.length() == 0) { return null; }
String bindruleStr = input.trim();
char firstChar = bindruleStr.charAt(0);   // crashes here

Decoding ( ) recurses into BindRule.decode(" ") (the parentheses stripped). The whitespace string has length 10, so it passes the length() == 0 guard; input.trim() then yields "", and charAt(0) on the empty string throws an unchecked StringIndexOutOfBoundsException. Being a RuntimeException, it escapes the aci-value validation paths instead of producing a clean decode error.

Fix

Trim first, then treat a blank (all-whitespace) bind rule as empty and return null — matching the original author's intent for empty input. The outer decode then rejects the malformed ACI with AciException(WARN_ACI_SYNTAX_INVALID_BIND_RULE_SYNTAX).

This is the same class of defect as #666 (StackOverflowError on repetitive targets) and #676 (ArrayIndexOutOfBoundsException on truncated percent-encoding): a malformed ACI must yield AciException, never an unchecked runtime exception. Consistent with #676, the defect is fixed at the parsing source rather than swallowed by a broad catch.

Tests

• New AciBodyTest.decodeBlankBindRuleThrowsAciException — the exact reproducer from the issue expects AciException.
• AciBodyTest passes locally (mvn -pl opendj-server-legacy test -Dtest=AciBodyTest): 8 tests, 0 failures.