Document XML parser features and clarify Log4j 1 bridge properties

[ppkarwasz]

This is a documentation-only improvement prompted by a report on the security mailing list (see #4263 for context):

• Adds an "External entities and validation" section to the migration guide: external XML entities are enabled when parsing Log4j 1 configuration files (kept by the bridge for backward compatibility) but not Log4j 2 ones, with guidance to inline entities or convert them to XIncludes, and the DTD-vs-XML-Schema validation difference. The threat model is linked next to each capability statement, so the statements cannot be quoted out of context.
• States the Log4j 2 XML parser features (no external DTD/entity retrieval, XInclude enabled when available) at the top of the XML format documentation.
• Makes the log4j.configuration and log4j1.compatibility property entries self-contained, so neither can be misread as depending on the other when deep-linked.
• Corrects the documented environment variable of both properties: log4j.configuration maps to LOG4J_CONFIGURATION (not LOG4J_CONFIGURATION_FILE, which maps to log4j.configurationFile) and log4j1.compatibility maps to LOG4J_1_COMPATIBILITY (not LOG4J_COMPATIBILITY); both verified against PropertiesUtil.
• Improves the class Javadoc of both XmlConfiguration classes, corrects their XXE_DOCUMENT suppression justifications, and bumps the org.apache.log4j.xml and org.apache.logging.log4j.core.config.xml package versions by a micro version accordingly.

User-visible change: the DOMConfigurator/PropertyConfigurator warning messages now link to logging.apache.org instead of logging.staged.apache.org (staging link shipped since 2.24.0).

Documentation for behavior that first ships in 2.27.0 (#4198) is deliberately excluded; it follows in a separate stacked PR (#4265).

Closes #4263

🤖 Generated with Claude Code

https://claude.ai/code/session_01LNsw2hhNuJ6tjsEU2tChnn

[ramanathan1504]

log4j-1.2-api/src/main/java/org/apache/log4j/PropertyConfigurator.java:155 (question, no fence)
Cannot be a suggestion: the remaining occurrence is in a different file, outside every hunk.

grep -rn logging.staged.apache.org over the repo leaves one more after this PR — src/site/antora/modules/ROOT/pages/faq.adoc:324 — worth sweeping it in the same commit?

[ramanathan1504]

@ppkarwasz
One thing left besides the faq.adoc sweep: the warning text in PropertyConfigurator.java and DOMConfigurator.java is user-visible, so does it want a src/changelog/.2.x.x entry alongside it?

[ppkarwasz]

The warning is more of a debugging tool: both java.util.logging and Log4j 1 has methods that can change the logging configuration automatically, which were active by default before version 2.24.0. We disabled them, because some old and deeply nested transitive dependencies were “helping” application developers in configuring logging (e.g. Nashorn).

Application developers usually don't need help with that. Those that were relying on it, will enable debug status logging and see the link to the correct documentation. I don't think a changelog entry is necessary for correcting a typo in a warning message.

[ramanathan1504]

@ppkarwasz Changelog entry missing

[ppkarwasz]

Same as in #4265: the only changes in code are to some compile-time annotations, which are not used at runtime.