Fix validator crashes on malformed METS content

[luis100]

Summary

Several SIP validation checks let exceptions from unchecked METS bean values or filesystem path resolution escape and crash the whole CLI run instead of being reported as a validation error.

• StructMapValidator: fileGrp.getUSE() can be null, causing an NPE on .equals("Representations"). Switched to a null-safe comparison (2 call sites).
• EARKSIPValidator / EARKPyIPValidator: mets/metsHdr can be absent from the XML, causing an NPE when eagerly reading its OAISPACKAGETYPE before component validation runs. Now guarded, so the missing header is instead reported by the metsHdr component validator (CSIP117/CSIP9), as it already correctly handles this case.
• FileSecValidator / DmdSecValidator / AmdSecValidator / StructMapValidator: resolving a decoded @href/@label against the IP path via Paths.resolve(...) throws InvalidPathException when it contains characters invalid in a filesystem path (e.g. a NUL byte embedded in the href). Now caught at every such call site and reported as a proper validation failure instead of crashing.
• DecoderUtils.normalizePath: hardened the same way as defense in depth, since it runs (pre-decoding) on every href processed by the validators above.
• StructValidator.isZipFile: avoid opening the IP path as a RandomAccessFile when it's already known to be a directory. This previously always threw FileNotFoundException for every folder-mode validation and spammed the log with a misleading stack trace, even though it was silently caught and handled correctly.

Test plan

• mvn compile — clean build
• mvn test — all 25 existing unit tests pass
• Ran the CLI validator against the full erroneous_sips_v2 corpus (51 SIPs, both directory and zip mode = 102 runs):
  • Baseline (pre-fix, on this same corpus): 5 runs crashed with an uncaught exception (NullPointerException / InvalidPathException), matching a real user-reported bug.
  • After this fix: all 102 runs complete cleanly (exit code 0) and produce a proper validation report; the previously-crashing SIPs are now correctly reported as INVALID with a clear issue message instead of a stack trace.
  • No change in outcome for the other 97 SIPs (same VALID/INVALID results as baseline).

🤖 Generated with Claude Code

https://claude.ai/code/session_011C1rByHgijBMAgvqTnmePS