Find Apache Commons BeanUtils property assignments

Finds calls to Apache Commons BeanUtils and PropertyUtils setters and bulk-copy methods (setProperty, populate, copyProperties, copyProperty, setNestedProperty, setSimpleProperty, setIndexedProperty, setMappedProperty) — including the equivalent instance-method forms on BeanUtilsBean and PropertyUtilsBean, and on any subclass of those, regardless of how the bean instance is obtained (getInstance(), new, injected field, etc.). When the property name or value flows from an untrusted source (e.g. HTTP request parameters), these calls enable bean-injection / mass-assignment (CWE-915) — an attacker can set any settable field on the bean, including ones the application never intended to expose. Per Sonar S4512 each call site needs human review for whether the property name and value come from trusted input. Detector only; does not modify code.