fix(sdk): reject key access entries without URLs (#423)

## Summary
- reject malformed key access entries whose URL is missing before TDF
load planning
- add regression coverage for the malformed manifest found by the
main-branch fuzz run
- move reader configuration creation outside the AssertJ exception
lambda to satisfy static analysis

## Rationale
The fuzz failure after #422 was not caused by the empty-manifest
validation itself. That fix allowed the corpus to proceed, exposing a
separate malformed-manifest path: a key access entry with a missing URL
reached Autoconfigure.KeySplitStep and triggered a NullPointerException.
This change rejects that manifest with an IllegalArgumentException
during manifest validation.

Failed job:
https://github.com/opentdf/java-sdk/actions/runs/39472084130/job/118798445562
Tracking issue: https://virtru.atlassian.net/browse/DSPX-5073

## Test plan
- mvn -pl sdk -am test -Dtest='ManifestTest,TDFReaderTest'
-Dsurefire.failIfNoSpecifiedTests=false (38 tests passed)
- mvn -pl sdk -am test -Dtest='Fuzzing#fuzzTDF'
-Dsurefire.failIfNoSpecifiedTests=false, replaying the exact crash
artifact from the failed job (9 corpus tests passed)

## Public API
No public API changes.

Signed-off-by: Elizabeth Healy <ehealy@virtru.com>

Author: elizabethhealy

sdk/src/main/java/io/opentdf/platform/sdk/Manifest.java

@@ -799,6 +799,8 @@ protected static Manifest readManifest(String manifestJson) {
         for (Manifest.KeyAccess keyAccess : result.encryptionInformation.keyAccessObj) {
             if (keyAccess == null) {
                 throw new IllegalArgumentException("Invalid null KeyAccess in manifest");
+            } else if (keyAccess.url == null) {
+                throw new IllegalArgumentException("Invalid KeyAccess with null url in manifest");
             }
         }
 

sdk/src/test/java/io/opentdf/platform/sdk/ManifestTest.java

@@ -14,6 +14,7 @@
 import java.util.stream.Stream;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
 public class ManifestTest {
@@ -260,6 +261,16 @@ void testAbsentDefaultsLeaveSegmentSizesAtZero() {
         assertThat(segment.encryptedSegmentSize).isZero();
     }
 
+    @Test
+    void rejectsKeyAccessWithoutUrl() {
+        String manifest = manifestWithSegments("{ \"hash\": \"aGFzaDA=\" }")
+                .replace(" \"url\": \"http://localhost:65432/kas\",", "");
+
+        assertThatThrownBy(() -> Manifest.readManifest(manifest))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessage("Invalid KeyAccess with null url in manifest");
+    }
+
     @Test
     void testReadingManifestWithObjectStatementValue() throws IOException {
         final Manifest manifest;

sdk/src/test/java/io/opentdf/platform/sdk/TDFReaderTest.java

@@ -89,8 +89,9 @@ void rejectsEmptyManifest(String manifest) throws IOException {
                 TDFWriter.TDF_PAYLOAD_FILE_NAME, PAYLOAD,
                 "0.manifest.json", manifest)) {
             var tdf = new TDF(new FakeServicesBuilder().setKas(TDFTest.kas).build());
+            var readerConfig = Config.newTDFReaderConfig();
 
-            assertThatThrownBy(() -> tdf.loadTDF(tdfBytes, Config.newTDFReaderConfig()))
+            assertThatThrownBy(() -> tdf.loadTDF(tdfBytes, readerConfig))
                     .isInstanceOf(IllegalArgumentException.class)
                     .hasMessage("Manifest is empty");
         }