fix: avoid format strings in FrontendUtils.console

[hej090224]

Description

FrontendUtils.console() passed a caller-controlled format parameter
straight into String.format(), which static analysis tools flag as
CWE-134 (uncontrolled format string), since the method's contract does not
guarantee the argument is a compile-time constant.

In the current codebase, console() is only called with the ANSI color
constants (GREEN, RED) as the "format" argument. Those constants used
to be full String.format() templates: an ANSI color escape prefix,
followed by a %s outlet for the message, followed by the ANSI reset
escape. This PR removes the String.format() call entirely: the color
constants now hold only the ANSI escape prefix, a new ANSI_RESET constant
holds the reset escape, and console() builds the output via plain string
concatenation (ansiColor + message + ANSI_RESET). The message argument is
therefore always printed literally and can never be interpreted as a format
string.

Changes

• flow-server/.../internal/FrontendUtils.java:
  • YELLOW, RED, GREEN, BRIGHT_BLUE no longer embed a %s outlet;
    they are now just the ANSI color escape prefix.
  • Added ANSI_RESET for the shared reset escape sequence.
  • console(String format, Object message) is now
    console(String ansiColor, String message); it concatenates the
    color, message, and reset instead of calling String.format().
  • Removed the now-unused import static java.lang.String.format.
• flow-server/.../internal/FrontendUtilsTest.java (new): unit tests for
  console().

No call sites needed changes: the only caller,
vaadin-dev-server/.../AbstractDevServerRunner.java, already passes plain
String constants (START, SUCCEED_MSG, FAILED_MSG) as the message,
so it compiles unchanged against the new signature and produces byte-for-byte
identical output (color prefix + message + reset).

Testing

New tests in FrontendUtilsTest verify:

• a plain message is wrapped with the given color and ANSI_RESET
• embedded newlines in the message are preserved exactly
• messages containing %s, %c, %n, and a literal % are printed
  verbatim rather than being interpreted as format specifiers

Verification commands run locally:

• mvn -pl flow-server -am -DskipITs -Dtest=FrontendUtilsTest -Dsurefire.failIfNoSpecifiedTests=false test → 3/3 passed
• mvn -pl vaadin-dev-server -am -DskipITs -DskipTests install → BUILD SUCCESS (confirms the only caller module still compiles against the new signature)
• mvn -pl flow-server spotless:check → BUILD SUCCESS (after spotless:apply)
• mvn -pl flow-server checkstyle:check → fails, but with a pre-existing, unrelated parser error in flow-server/.../signals/shared/impl/MutableTreeRevision.java (a record pattern in instanceof that the bundled checkstyle grammar can't parse); this file is untouched by this PR and the failure reproduces on upstream/main without this change.

Fixes #9263

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[mcollovati]

@hej090224 could you please sign the CLA? Otherwise we cannot proceed with this PR.

[hej090224]

@mcollovati Apologies for the delayed response — I missed the CLA notification. I'll sign the CLA now via the link above.