Find Content-Length header writes on HttpServletResponse (CVE-2026-22732)

Detects HttpServletResponse.setHeader, setIntHeader, or addIntHeader calls whose first argument resolves (directly or via local variable) to the literal Content-Length (case-insensitive). These three overloads are NOT overridden by Spring Security's OnCommittedResponseWrapper, so onResponseCommitted() never fires and the lazy-added security headers (X-Frame-Options, X-Content-Type-Options, Cache-Control, etc.) are silently dropped — CVE-2026-22732. addHeader is intentionally excluded: the wrapper special-cases it. Also covers WebFlux HttpHeaders.set / add for Content-Length. In addition to marking Java sinks, attaches a {@code SearchResult} marker to every source file in the affected project so this recipe can be used as a declarative precondition for build-level recipes.