Find unconditional WebFlux response commit calls (CVE-2026-22732)

Detects WebFlux calls that commit a ServerHttpResponse outside the lazy header-writing path: writeWith(..), writeAndFlushWith(..), setComplete(), and HttpHeaders.setContentLength(long). Under CVE-2026-22732 these patterns cause Spring Security's lazy-added security headers to be dropped. The sibling recipe FindHttpResponseContentLengthHeader covers the servlet setHeader / setIntHeader / addIntHeader case. In addition to marking Java sinks, attaches a SearchResult marker to every source file in the affected project so this recipe can be used as a declarative precondition for build-level recipes.