update java test cases to pass on java 18

tests/dynamic_fixtures/java/quarkus_route/Benign.java

@@ -1,6 +1,5 @@
 // Quarkus reactive route, benign.
 
-import io.quarkus.runtime.Quarkus;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 

tests/dynamic_fixtures/java/quarkus_route/Vuln.java

@@ -1,8 +1,8 @@
 // Quarkus reactive route, vulnerable. The harness keeps the real
 // Jakarta REST annotations on the classpath and replays the route
-// through those annotations.
+// through those annotations. Quarkus REST routes are authored with the
+// `jakarta.ws.rs` annotations below, so no live Quarkus runtime is needed.
 
-import io.quarkus.runtime.Quarkus;
 import jakarta.ws.rs.GET;
 import jakarta.ws.rs.Path;
 

tests/dynamic_fixtures/java/quarkus_route/pom.xml

@@ -9,11 +9,16 @@
     <maven.compiler.target>17</maven.compiler.target>
   </properties>
   <dependencies>
-    <dependency>
-      <groupId>io.quarkus</groupId>
-      <artifactId>quarkus-resteasy-reactive</artifactId>
-      <version>3.8.3</version>
-    </dependency>
+    <!--
+      The route-replay harness reflects over the Jakarta REST annotations
+      (`@Path`/`@GET`) at runtime; it never touches a live Quarkus server,
+      so `jakarta.ws.rs-api` is the only jar it needs.  Pulling the full
+      `quarkus-resteasy-reactive` runtime (Vert.x, Netty, RESTEasy, 200+
+      transitive jars) only bloated `-cp lib/*`, which slowed cold JVM
+      startup past the 5s run timeout on contended CI runners and made
+      this fixture flaky.  Quarkus REST routes are written with these very
+      `jakarta.ws.rs` annotations, so the shape stays faithful.
+    -->
     <dependency>
       <groupId>jakarta.ws.rs</groupId>
       <artifactId>jakarta.ws.rs-api</artifactId>