[LivingLikeKrillin]

Closes #700.

What

• Moves plc4j/tools/opcua-server from Eclipse Milo 0.6.16 to 1.1.8. Milo has published no 0.6.x release since 0.6.16; its releases since then are on the 1.x line.
• Milo 1.x reorganised the server SDK, certificate handling and transport bootstrap, so this is a port rather than a version bump; the certificate and transport bootstrap in OPCUAServer follows the pattern of the example server that ships with Milo.
• pom.xml: the five 0.6.16 Milo artifacts are replaced by milo-sdk-server and milo-transport 1.1.8. 7 files change, one of them a new test.

Compatibility

• The trust list keeps the 0.6 layout: pki/issuers/{certs,crl} rather than the pki/issuer/{certs,crl} default of Milo 1.x FileBasedTrustListManager; rejected certificates stay directly in pki/rejected (the example server that ships with Milo uses pki/rejected/certs).
• The server certificate is taken from the keystore entry the tool loads: the first alias of an existing keystore, as in 0.6, or plc4x-certificate-alias for a newly generated one. Left to itself, Milo 1.x's KeyStoreCertificateStore looks for an entry named server-rsa-sha256, and DefaultApplicationGroup writes a second entry into the keystore when it does not find one.

Behaviour changes

• Anonymous access becomes opt-in. In 0.6 anonymous users were accepted and every tag node is created with UserAccessLevel READ_WRITE, so anonymous clients were granted read and write access to every configured tag.
• Milo 1.x dropped the anonymous flag from UsernameIdentityValidator; anonymous access now needs a separate AnonymousIdentityValidator. A new YAML key allowAnonymousAccess (default false) adds that validator and the anonymous user token policy together; without it, clients authenticate with username/password or an X.509 user token.
• Upgrade note: deployments whose clients connect anonymously must add allowAnonymousAccess: true to the server configuration.
• X.509 user certificates keep the existing accept-all check (X509IdentityValidator(c -> true)); this change adds no user-certificate trust or authorization checks.
• The username and X.509 user token policies now name Basic256Sha256 instead of Basic256, because Milo's predefined USER_TOKEN_POLICY_USERNAME / USER_TOKEN_POLICY_X509 changed between 0.6.16 and 1.1.8.
• The DataTypeDictionaryManager is removed. No types were registered with it, but the (empty) data type dictionary node it published under OPCBinarySchema_TypeSystem is no longer there.

Validation

Setup: Java 21, the repository Maven wrapper, a config with one simulated:// device (a RANDOM INT tag and a STATE INT tag), and the PLC4X 1.0.0 opcua driver as the client, run from temporary local test classes that are not part of this PR.

• ./mvnw -Pwith-java -pl :plc4x-opcua-server -am verify succeeds: 8 tests, 4 passed (including the new ConfigurationTest), 4 skipped by the class-level @Disabled on OpcuaPlcDriverTest.
• Migration: I created a security directory with the current develop server (Milo 0.6.16), added an issuer certificate to pki/issuers/certs and a client certificate to pki/trusted/certs, and started this branch on it. The keystore file stayed byte-for-byte unchanged, both certificates were loaded into the trust list, a Basic256Sha256 / SignAndEncrypt read with that client succeeded, pki/rejected stayed empty and no pki/issuer was created. With the keystore replaced by one whose only alias is my-own-cert, the alias and the file stayed unchanged and a secure read succeeded. CRLs were not covered.
• Fresh installation: the generated keystore holds only plc4x-certificate-alias; a restart leaves it byte-for-byte unchanged and a secure read succeeds. An untrusted client certificate is refused (the server answers Bad_SecurityChecksFailed) and written directly to pki/rejected.
• Anonymous: with allowAnonymousAccess not set in the test configuration, the driver found no None endpoint offering anonymous login. With allowAnonymousAccess: true, anonymous read and write requests returned OK over both None and Basic256Sha256 / SignAndEncrypt, and username login still worked.
• Username/password over None: read OK. Basic256Sha256 / SignAndEncrypt with a trusted client certificate and the server certificate pinned: read OK, write 1234 to the STATE tag and read back 1234.
• A cyclic subscription requested at 500 ms delivered OK notifications (timing was not measured); a read with an X.509 user token and a browse through the driver also succeeded.

Not in this PR

• The user documentation page for this tool lives in the core repository (apache/plc4x, website/asciidoc/modules/users/pages/tools/opcua-server.adoc) and does not mention allowAnonymousAccess yet; I will follow up there once this is merged.
• OpcuaPlcDriverTest stays @Disabled (its existing reason is OutOfMemoryErrors, which I did not investigate); its tests connect anonymously, so they need updating when re-enabled. The runtime checks above are not committed; I can add integration tests in a follow-up if wanted.
• The trust list's file watcher is not closed on shutdown. This was already the case with the 0.6 DefaultTrustListManager; I left it unchanged.