Fix XML.unescape rejecting valid whitespace numeric character references

[dong0713]

Summary

Fixes #1059 — XML.unescape("
") and XML.toJSONObject("<a>&#10;</a>") throw JSONException: Invalid numeric character reference: 
 in versions after 20251224 (regression introduced by #1045).

Root Cause

XML.mustEscape(int cp) is shared by both the serialization path (XML.escape) and the deserialization path (XMLTokener.unescapeEntity). The method's Javadoc and comment correctly quote the W3C XML 1.0 valid-character range:

#x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]

However, the implementation only checked [#x20-#xD7FF] onwards in its range clause, omitting #x9 / #xA / #xD (TAB, LF, CR). Although the ISO-control clause explicitly excluded those three codepoints, the negated range clause (!(...)) still evaluated to true for them, so mustEscape(0xA) returned true and unescapeEntity threw JSONException.

Fix

Align the range clause with the W3C spec by explicitly allowing cp == 0x9, cp == 0xA, and cp == 0xD, matching the comment that was already documented.

Before:

|| !(
    (cp >= 0x20 && cp <= 0xD7FF)   // missing #x9, #xA, #xD
    || (cp >= 0xE000 && cp <= 0xFFFD)
    || (cp >= 0x10000 && cp <= 0x10FFFF)
)

After:

|| !(
    cp == 0x9
    || cp == 0xA
    || cp == 0xD
    || (cp >= 0x20 && cp <= 0xD7FF)
    || (cp >= 0xE000 && cp <= 0xFFFD)
    || (cp >= 0x10000 && cp <= 0x10FFFF)
)

Behaviour Change

Input	Before (v20260522+)	After
XML.unescape("
")	JSONException	"\n"
XML.unescape("	")	JSONException	"\t"
XML.unescape("
")	JSONException	"\r"
XML.unescape("
")	JSONException	"\n"
XML.toJSONObject("<a>&#10;</a>")	JSONException	{"a":""}
XML.unescape("&#32;")	" " (unchanged)	" "

Testing

• Added testValidWhitespaceNumericEntityUnescape — verifies decimal and hex references for TAB/LF/CR via XML.unescape()
• Added testValidWhitespaceNumericEntityToJSONObject — verifies XML.toJSONObject() accepts 	, 
, 
 without throwing (regression test for org.json.XML.unescape("
"); throws org.json.JSONException: Invalid numeric character reference: 
 #1059)
• Full test suite: 791 tests, 0 failures, 0 errors, 6 skipped (pre-existing)

Fixes #1059

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[stleary]

What problem does this code solve?
XML.mustEscape() does not handle whitespace codepoints (&#nnn;) correctly for whitespace chars.

Risks
Low

Changes to the Existing Behavior
Codepoints for tab, newline, and carriageReturn will no longer throw an exception

Changes to the API
No

Will this require a new release?
Yes

Should the documentation be updated?
No

Unit Tests
New unit tests were added.

Refactoring
None

Review status
APPROVED

Starting 3-day comment window

[holubec-petr]

We also discovered the same behavior, and not following the JSON spec, especially around line break characters, break our solution.

Can we expect a new release of this library when the fix is merged?

[stleary]

@holubec-petr Yes, there will be a new release when this PR is merged