fix(spotbugs): update filter justifications and seal finalizer mitigation on TsaClient

config/spotbugs/exclude.xml

@@ -78,6 +78,7 @@
             <Class name="br.com.cybercore.signer.core.crypto.SigningService"/>
             <Class name="br.com.cybercore.signer.core.protocol.CcspServer"/>
             <Class name="br.com.cybercore.signer.core.provider.Pkcs12CertificateProvider"/>
+            <Class name="br.com.cybercore.signer.core.crypto.tsa.TsaClient"/>
             <Class name="br.com.cybercore.signer.ui.tray.SystemTrayManager"/>
             <Package name="~br\.com\.cybercore\.signer\.ui\.view.*"/>
         </Or>
@@ -161,4 +162,13 @@
         <Class name="br.com.cybercore.signer.app.CyberCoreSignerApplication"/>
     </Match>
 
+    <!--
+        11. Carregamento de driver PKCS#11 (middleware de fabricante de hardware criptográfico)
+        apontando para bibliotecas dinâmicas do sistema operacional (.dll no Windows ou .so no Linux).
+    -->
+    <Match>
+        <Bug pattern="PATH_TRAVERSAL_IN"/>
+        <Class name="br.com.cybercore.signer.core.provider.Pkcs11CertificateProvider"/>
+    </Match>
+
 </FindBugsFilter>

modules/cybercore-core/src/main/java/br/com/cybercore/signer/core/crypto/tsa/TsaClient.java

@@ -29,7 +29,7 @@ import java.util.Objects;
  * Cliente resiliente de Carimbo do Tempo (TSA RFC 3161) com suporte a retentativas com backoff,
  * timeout configurável e fallback automático para servidores secundários.
  */
-public class TsaClient {
+public final class TsaClient {
 
     private static final Logger logger = LoggerFactory.getLogger(TsaClient.class);
     private static final SecureRandom SECURE_RANDOM = new SecureRandom();