Update spotbugs and related new warnings (fixes #157)

acme4j-smime/src/main/java/org/shredzone/acme4j/smime/email/EmailProcessor.java

@@ -13,6 +13,7 @@
  */
 package org.shredzone.acme4j.smime.email;
 
+import static java.util.Collections.unmodifiableCollection;
 import static java.util.Objects.requireNonNull;
 
 import java.net.URL;
@@ -208,14 +209,14 @@ public final class EmailProcessor {
      * Returns the sender of the "challenge" email.
      */
     public InternetAddress getSender() {
-        return sender;
+        return (InternetAddress) sender.clone();
     }
 
     /**
      * Returns the recipient of the "challenge" email.
      */
     public InternetAddress getRecipient() {
-        return recipient;
+        return (InternetAddress) recipient.clone();
     }
 
     /**
@@ -224,7 +225,7 @@ public final class EmailProcessor {
      * Empty if there was no reply-to header, but never {@code null}.
      */
     public Collection<InternetAddress> getReplyTo() {
-        return replyTo;
+        return unmodifiableCollection(replyTo);
     }
 
     /**

acme4j-smime/src/main/java/org/shredzone/acme4j/smime/exception/AcmeInvalidMessageException.java

@@ -20,6 +20,7 @@ import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import org.bouncycastle.i18n.ErrorBundle;
 import org.bouncycastle.i18n.LocalizedException;
 import org.shredzone.acme4j.exception.AcmeException;
@@ -93,6 +94,7 @@ public class AcmeInvalidMessageException extends AcmeException {
      *
      * @since 2.16
      */
+    @SuppressFBWarnings("EI_EXPOSE_REP")   // errors is always an unmodifiable list
     public List<ErrorBundle> getErrors() {
         return errors;
     }