Fix Java 8 build breaks in OIDC device flow

The JDK 8 CI job failed to compile two Java 9+ constructs that a local
JDK 25 build silently accepts (newer rt.jar has the APIs, and -source
without --release does not enforce the Java 8 platform):

- Utf16Sink declared a private interface method, putUnicodeEscape, a
  Java 9 feature. Move it to DisplaySafe as a package-private static
  helper, putUnicodeEscape(Utf16Sink, int); the two putAsPrintable
  overloads now call it. DisplaySafe already owns the display-escaping
  policy and shares the package, so the helper stays out of the public
  API. The escape logic is moved verbatim.

- OidcDeviceAuth.urlEncode called URLEncoder.encode(String, Charset),
  a Java 10 overload. Switch to the Java 8 encode(String, String) form
  and catch the (unreachable for UTF-8) UnsupportedEncodingException.

Verified: the three changed files compile under --release 8, the full
core module compiles, and LineSenderExceptionTest,
LineHttpSenderErrorResponseTest, JsonLexerTest and OidcDeviceAuthTest
stay green (156 tests).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: glasstiger

core/src/main/java/io/questdb/client/cutlass/auth/OidcDeviceAuth.java

@@ -45,8 +45,8 @@
 import io.questdb.client.std.str.DirectUtf8Sequence;
 import io.questdb.client.std.str.StringSink;
 
+import java.io.UnsupportedEncodingException;
 import java.net.URLEncoder;
-import java.nio.charset.StandardCharsets;
 import java.util.concurrent.locks.ReentrantLock;
 
 /**
@@ -885,7 +885,13 @@ private static boolean settingsChannelIsPlaintext(Endpoint server) {
     }
 
     private static String urlEncode(String value) {
-        return URLEncoder.encode(value, StandardCharsets.UTF_8);
+        try {
+            // the Charset overload is Java 10; the client targets Java 8, so use the String-charset form
+            return URLEncoder.encode(value, "UTF-8");
+        } catch (UnsupportedEncodingException e) {
+            // UTF-8 is guaranteed present on every JVM, so this is unreachable; rethrow defensively
+            throw new OidcAuthException(e).put("UTF-8 encoding is not supported");
+        }
     }
 
     private static void validateEndpointOrigins(Endpoint tokenEndpoint, Endpoint deviceAuthorizationEndpoint, Endpoint issuer) {

core/src/main/java/io/questdb/client/std/str/DisplaySafe.java

@@ -24,6 +24,8 @@
 
 package io.questdb.client.std.str;
 
+import static io.questdb.client.std.Numbers.hexDigits;
+
 /**
  * Shared classifier for whether a code point is safe to show in a terminal or a log line. It is the one
  * source of truth for the client's display-escaping: {@link Utf16Sink#putAsPrintable(CharSequence)} escapes
@@ -71,4 +73,22 @@ public static boolean isDisplaySafe(int cp) {
     public static boolean isUnsafeForDisplay(int cp) {
         return !isDisplaySafe(cp);
     }
+
+    // Escapes a code point to one (BMP) or two (supplementary, as its surrogate pair) visible \\uXXXX
+    // sequences, so the escaped value still names the original char. Emitting all four hex digits keeps a
+    // char above U+00FF (e.g. U+202E) correct rather than truncated to its low byte. A static helper here
+    // (not a private method on Utf16Sink) keeps the source Java 8 - private interface methods are Java 9.
+    static void putUnicodeEscape(Utf16Sink sink, int cp) {
+        if (cp > 0xFFFF) {
+            putUnicodeEscape(sink, Character.highSurrogate(cp));
+            putUnicodeEscape(sink, Character.lowSurrogate(cp));
+            return;
+        }
+        sink.put('\\');
+        sink.put('u');
+        sink.put(hexDigits[(cp >> 12) & 0xF]);
+        sink.put(hexDigits[(cp >> 8) & 0xF]);
+        sink.put(hexDigits[(cp >> 4) & 0xF]);
+        sink.put(hexDigits[cp & 0xF]);
+    }
 }

core/src/main/java/io/questdb/client/std/str/Utf16Sink.java

@@ -26,8 +26,6 @@
 
 import org.jetbrains.annotations.Nullable;
 
-import static io.questdb.client.std.Numbers.hexDigits;
-
 /**
  * Family of sinks that write out <b>character</b> value as UTF16 encoded bytes. This interface
  * is separate from {@link CharSink} to achieve two goals:
@@ -58,7 +56,7 @@ default void putAsPrintable(CharSequence nonPrintable) {
                     put(nonPrintable.charAt(i + j));
                 }
             } else {
-                putUnicodeEscape(cp);
+                DisplaySafe.putUnicodeEscape(this, cp);
             }
             i += count;
         }
@@ -71,7 +69,7 @@ default void putAsPrintable(char c) {
         if (DisplaySafe.isDisplaySafe(c)) {
             put(c);
         } else {
-            putUnicodeEscape(c);
+            DisplaySafe.putUnicodeEscape(this, c);
         }
     }
 
@@ -102,21 +100,4 @@ default Utf16Sink putNonAscii(long lo, long hi) {
         Utf8s.utf8ToUtf16(lo, hi, this);
         return this;
     }
-
-    // Escapes a code point to one (BMP) or two (supplementary, as its surrogate pair) visible \\uXXXX
-    // sequences, so the escaped value still names the original char. Emitting all four hex digits keeps a
-    // char above U+00FF (e.g. U+202E) correct rather than truncated to its low byte.
-    private void putUnicodeEscape(int cp) {
-        if (cp > 0xFFFF) {
-            putUnicodeEscape(Character.highSurrogate(cp));
-            putUnicodeEscape(Character.lowSurrogate(cp));
-            return;
-        }
-        put('\\');
-        put('u');
-        put(hexDigits[(cp >> 12) & 0xF]);
-        put(hexDigits[(cp >> 8) & 0xF]);
-        put(hexDigits[(cp >> 4) & 0xF]);
-        put(hexDigits[cp & 0xF]);
-    }
 }