Java extraction on Windows emits native-access warnings from SubstResolver on JDK 24+ #23044

When extracting a Java project on Windows with JDK 24+, CodeQL emits JVM warnings because com.semmle.util.files.SubstResolver calls System.load without native access enabled.

Extraction succeeds, but the unexpected warnings can cause failures in build wrappers that parse compiler output as diagnostics.

Steps to reproduce

On Windows, with CodeQL CLI v2.27.4 and JDK 24+ on PATH, create Hello.java:

public class Hello {
    public static void main(String[] args) {
        System.out.println("Hello");
    }
}

Compile normally as a control:

javac Hello.java
Remove-Item Hello.class

Then compile under CodeQL tracing:

codeql database create codeql-db --language=java --source-root=. --command="javac Hello.java"

Actual behavior

Normal compilation does not emit the warning. Compilation under CodeQL emits the following warning block:

WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::load has been called by com.semmle.util.files.SubstResolver in an unnamed module (file:/C:/codeql_temp/codeql3000/distribution/codeql/java/tools/semmle-extractor-java.jar)
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

Expected behavior

CodeQL extraction should not introduce native-access warnings into otherwise successful Java compilation.

JEP 472 introduced these warnings by default in JDK 24. This also raises a forward-compatibility concern when native access becomes denied by default.

Relevant source

SubstResolver.java loads canonicalize.dll on Windows using System.load.

The file was introduced by @jketema in #22129