…ourceComparator classes

The <includeAll> changelog directive accepts resourceFilter and
resourceComparator attributes that specify fully-qualified Java class
names. Both are loaded via Class.forName(name, true,
ContextClassLoader).getConstructor().newInstance() with no allowlist
and no marker-interface check before construction:

  // DatabaseChangeLog.java:641
  resourceFilter = (IncludeAllFilter) Class.forName(resourceFilterDef,
      true, Thread.currentThread().getContextClassLoader())
      .getConstructor().newInstance();

  // DatabaseChangeLog.java:731
  resourceComparator = (Comparator<String>) Class.forName(
      resourceComparatorDef, true,
      Thread.currentThread().getContextClassLoader())
      .getConstructor().newInstance();

The initialize=true argument fires the named class's static <clinit>
initializer AT LOAD TIME — before the cast or any other safety check
could reject the load. Any class on the JVM classpath is reachable
via a malicious <includeAll>: name the class, get its static-init
code and zero-arg ctor invoked as a side effect (CWE-470: Use of
Externally-Controlled Input to Select Classes or Code, aka Unsafe
Reflection).

Same surface as <customChange> (DAT-23016 / PR #7748) and
<customPrecondition> (DAT-23017 / PR #7749), gated by
liquibase.allowCustomChange. The audit author explicitly suggested
unifying B2/B3/B5 under one flag. After deliberation: a SEPARATE
flag here for two reasons:

1. <includeAll> is not a "custom-*" element. Extending
   liquibase.allowCustomChange to gate it would stretch the flag
   name beyond what an operator reading 'allowCustomChange' would
   reasonably expect.

2. Distinct flags give operators independent control surface — an
   embedder who uses customChange but not includeAll filters can
   lock down each independently.

To prevent the "operator missed a flag" footgun that motivated #7749
sharing #7748's flag, this PR's new-flag description explicitly
cross-references liquibase.allowCustomChange: operators reading
either description learn that fully locking down changelog-controlled
class loading requires setting BOTH flags to false.

Three pieces:

1. New GlobalConfiguration.ALLOW_INCLUDE_ALL_CLASSES flag
   (liquibase.allowIncludeAllClasses). Boolean, defaults to true.
   Description references CWE-470 and cross-references
   liquibase.allowCustomChange.

2. Two inline gates in DatabaseChangeLog:

   (a) In handleIncludeAll() at the resourceFilter Class.forName
       call site (line 641 in the audit reference). Throws
       SetupException with the configured-off message BEFORE the
       Class.forName, so the static initializer of the named class
       never fires when the flag is false.

   (b) In determineResourceComparator() at the resourceComparator
       Class.forName call site (line 731 in the audit reference).
       Throws UnexpectedLiquibaseException (the method has no
       checked-throws clause). Critically, the gate fires BEFORE
       the try/catch block — the existing
       ReflectiveOperationException-catches-and-falls-back-to-
       standard logic would otherwise silently degrade the
       configured-off intent into the default comparator (which
       would mask the rejection from the operator and look identical
       to the success path in logs).

3. Five new Spock specs in DatabaseChangeLogTest (195 pre-existing
   → 200 total):

   - determineResourceComparator returns the standard comparator
     when allowIncludeAllClasses=true (default) and
     resourceComparatorDef is null. Default-path preservation.
     Behaviour-asserts the comparator (comparator.compare(...))
     rather than reference-equality because
     getStandardChangeLogComparator() returns a fresh lambda each
     call.

   - determineResourceComparator falls back to standard comparator
     at default flag when resourceComparator class fails to load.
     Pins the pre-fix catch behaviour — flag=true must not regress
     the existing graceful-fallback path.

   - determineResourceComparator throws UnexpectedLiquibaseException
     BEFORE Class.forName when allowIncludeAllClasses=false. Uses
     a non-existent class name to prove the gate ran first: pre-fix
     code path would have produced a fallback to the standard
     comparator (no exception); after-fix produces ONLY the
     configured-off error — the loader never ran. Asserts message
     shape (flag-name in both directions + "NOT loaded" +
     "resourceComparator") as proof-of-short-circuit.

   - determineResourceComparator with null resourceComparatorDef
     returns standard comparator even when
     allowIncludeAllClasses=false. Pins that the gate does NOT
     over-reach into the default-comparator path.

   - handleIncludeAll throws SetupException BEFORE Class.forName
     when allowIncludeAllClasses=false and resourceFilter is
     specified. Parser-path test exercising the inline gate at
     line 641 via the standard load() entry point with a
     ParsedNode-based changelog.

200/200 DatabaseChangeLogTest specs pass + 11/11 GlobalConfigurationTest.
Broader sanity sweep: 262 tests across DatabaseChangeLogTest (200),
XMLChangeLogSAXParser_RealFile_Test (30), and GlobalConfigurationTest
(11) all pass with the new flag defaulting to true — no behaviour
change for any existing <includeAll> at the default.

…lasses-opt-out-gate