fix: handle null password in MqttContext.isValid to avoid NPE

[wy471x]

CONNECT with password flag 0 yields a null passwordInBytes, which caused new String((byte[]) null) to throw and hang the connection without a CONNACK. Treat null as empty so the client receives CONNECTION_REFUSED_BAD_USER_NAME_OR_PASSWORD, and add unit tests.

Make sure that:

• You have read the contribution guidelines.
• You submit test cases (unit or integration tests) that back your changes.
• Your local test passed ./mvnw clean install -Dmaven.javadoc.skip=true.

Summary

Changes:

• Fix NPE in MqttContext.isValid: new String(passwordInBytes) throws when msg.payload().passwordInBytes() is null — any CONNECT with the password flag bit set to 0 (anonymous or
  username-only clients). The handler thread dies and the client never receives a CONNACK, leaving the connection hanging.
• Null passwordInBytes is now treated as empty, so validation fails gracefully and the client receives CONNECTION_REFUSED_BAD_USER_NAME_OR_PASSWORD instead of a hang.

Test Cases:

• Added junit-jupiter test dependency and MqttContextTest with 6 cases covering null/empty/wrong password, null/empty username, and valid credentials.

close #6847

[Aias00]

Review: #6924 fix NPE in MqttContext.isValid on null passwordInBytes

Decision: APPROVE

What changed

• MqttContext.isValid(...): when passwordInBytes is null (CONNECT with password flag bit = 0, i.e. anonymous / username-only clients), new String((byte[]) null) previously threw NPE and killed the handler thread, so the client never got a CONNACK and the connection hung. Now null is treated as empty string via Objects.isNull(passwordInBytes) ? "" : new String(passwordInBytes), so validation fails gracefully with CONNECTION_REFUSED_BAD_USER_NAME_OR_PASSWORD.
• Added import java.util.Objects;.
• Added junit-jupiter test dependency (test scope) and MqttContextTest with 6 cases (correct creds, null/empty password, wrong password, null/empty username).

Verification

• Objects import is added in the same class, so it compiles.
• The null branch is handled before new String(...), eliminating the NPE path.
• Test covers both the null and empty-password cases.

Notes

• Clean, minimal, spec-reasonable fix. No behavioral side effects for valid clients.

Good work — approving.