Fix SDK build and unit tests on JDK 27

[mihir-pradhan]

Description

Makes duo-universal-sdk build and test on JDK 27, and adds JDK 27 to CI so it does not regress.

POM changes:

• maven-assembly-plugin 2.5.4 → 3.8.0, goal attached → single, since attached was removed in 3.x
• maven-surefire-plugin 2.22.1 → 3.6.0, dropping its pinned junit-platform-surefire-provider, which 3.x cannot use and no longer needs
• mockito-core 3.11.2 → 5.23.0, with a jdk8 profile pinning 4.11.0 because Mockito 5 requires Java 11
• byte-buddy 1.15.4 → 1.17.7 with byte-buddy-agent alongside it, both test scoped and excluded from converter-jackson

Two static imports in ClientTest move from org.mockito.Matchers, removed in Mockito 4, to ArgumentMatchers.

byte-buddy is only needed so Mockito can generate mocks. jackson-databind declares it but never references it, and nothing else on the runtime classpath does either, so it no longer ships: the fat jar drops from 7.3 MB to 3.1 MB and the CycloneDX SBOM from 9 components to 8. Consumers no longer receive byte-buddy transitively from this SDK.

Both CI jobs gain a JDK 27 leg. They use Zulu rather than Temurin: JDK 27 went GA on 2026-09-15 but Adoptium's newest feature release is still 26, so distribution: temurin with java-version: 27 fails before Maven runs. Worth collapsing back to a single distribution once Temurin 27 ships. Existing legs stay on Temurin and job names are unchanged, so this only adds SDK - Java 27 and Example App - Java 27.

Motivation and Context

On JDK 27 the assembly plugin fails with No such archiver: 'jar', so no -jar-with-dependencies.jar is produced, and 47 of 87 tests error. The test errors have two separate causes: 7 in DuoConnectorTest, where Mockito 3.11 cannot generate mocks on a JDK this new, and 40 in ClientTest, where src/test/resources/mockito-extensions/org.mockito.plugins.MockMaker additionally forces Mockito's inline mock maker, which cannot self-attach to a modern JVM before Mockito 5. Neither failure was caught because the CI matrix stopped at Java 21.

How Has This Been Tested?

On JDK 27, unscoped mvn -B install succeeds with the assembly step enabled and mvn test passes 87/87, covering both modules. The three steps CI runs for the SDK — clean install, checkstyle:check and -P release package, each -pl duo-universal-sdk — also pass on JDK 27 and on JDK 17, producing all four jars. Client.class is still class file major 52, and the example app starts on JDK 27 and serves HTTP 200.

No JDK 8 was available locally, so the jdk8 profile could only be verified as far as resolving to Mockito 4.11.0 and passing 87/87 on a JDK 17 VM. The Java 8 leg on this PR closes that gap: it passes, confirming Mockito 4.11's inline mock maker self-attaches on a real Java 8 VM. Java 11 and 21 pass as well, so there is no regression on the supported JDKs.

Types of Changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

[jeffreyparker]

I noticed a pre-existing issue (not related to your PR, but we might want to fix since we're touching this area). byte-buddy is only needed for tests, but is currently configured to be a default dependency, so it's part of the production builds as well.

We can add this to scope it to only tests:

<scope>test</scope>