Harden EventFilter validation and event delivery isolation

[kevinherron]

Several independent defects in the server-side EventFilter delivery path let a single monitored item's filter interfere with event delivery to other items, or let filters that Part 4 says are invalid through validation only to fail on every event afterwards.

EventContentFilter.decodeOperands cast each decoded operand to FilterOperand unchecked, so an operand that decodes to some other structure raised ClassCastException and one with an unknown encoding id raised UaSerializationException. Neither is a UaException, so both escaped MonitoredEventItem.onEvent. Related to that, installFilter only looked at select clause and element status codes when deciding whether to arm the filter, so an element whose operand had been reported as Bad_FilterOperandInvalid still armed. And ServerEventNotifier.fire notified listeners in a plain loop, so an exception from one listener stopped delivery to every listener registered after it and propagated to the caller.

Operands are now decoded explicitly and reported as Bad_FilterOperandInvalid, operand status codes participate in the arming decision, onEvent contains any exception from evaluation, and fire isolates each listener while leaving notifier-scope resolution and per-listener scope filtering unchanged. The item result for a filter that validates with errors is unchanged: the item is created with Good and the EventFilterResult carries the per-clause codes, as before.

Two further issues in ElementOperand handling are addressed. validate recorded Good for every ElementOperand; it now enforces Part 4 §7.7.4.2 (the index must be greater than the containing element's index and reference an existing element) so these filters are rejected at CreateMonitoredItems. And the cycle guard added in #1780 tracks only the current evaluation path, so an element referenced from several places in an acyclic filter was evaluated once per path, which is exponential for a chain of And elements that each reference the next element twice. DefaultOperatorContext now caches each element's result, or the UaException it raised, for the lifetime of one event evaluation. This is sound because element evaluation has no side effects within a single event.

On this branch DefaultConditionManager.deliverRefresh already isolated snapshot replay and RefreshEnd delivery per item but delivered RefreshStart in an unguarded loop; it now guards RefreshStart the same way, and tests pin the per-item isolation of the whole bracket and the release of the per-Subscription refresh guard. Tests also cover event items whose filter validates with errors through SubscriptionManager creation and the SetMonitoringMode registration toggle, and a throwing in-scope listener alongside scope filtering in ServerEventNotifier.fire. The onRefreshMarker, overflow, and onConditionEventOverflow paths were reviewed: they only reach select, which converts UaException to a null field, and their callers already guard with catch (Throwable) or catch (Exception), so no change was needed there.

Verification: spotless:apply, clean compile, and the full sdk-server test suite pass, along with the integration tests for event filter operators, event routing, ConditionRefresh, and the new event delivery isolation test. Each new unit test was also run against the unmodified production code to confirm it fails there.

The same fixes are opened separately against main, where the surrounding delivery code has diverged.