fix: explosion & knockback bypasses of entity claim protection

[noaskers]

Closes #479
Closes #461
Closes #497
Closes #297

Bug

Two separate ways to damage or move entities inside a claim from outside it:

1. End crystals (and player-lit TNT) detonated just outside a claim boundary kill
   players and destroy armor stands inside it, dropping their items. Creepers are
   correctly blocked, which is what makes it look inconsistent.
2. Spears push armor stands out of claims without damaging them.

Root Cause

Explosions. In cloplib's BukkitEntityDamageListener, onEntityDamageEntity
returns early down the player-damage path whenever getPlayerSource() resolves the
damager to a player. Since that unwraps projectile shooters and passengers, a blast
attributable to a player never reaches the explosion branch below, and gets checked
against player_damage_player (or player_damage_persistent_entity for armor
stands) instead of explosion_damage_entity. player_damage_player is in
defaultFlags, so the damage is allowed through.

Spears. Spears use the piercing_weapon component, which applies knockback
without dealing damage, so no EntityDamageByEntityEvent fires at all and nothing
in the protection layer sees it.

Changes

• Check explosion_damage_entity for all explosion damage at EventPriority.LOW,
  ahead of cloplib, regardless of what the blast is attributed to. Monsters are
  skipped, so existing behaviour there is unchanged.
• Handle EntityPushedByEntityAttackEvent for knockback that isn't damage. It's
  registered reflectively since it isn't in the Paper API version this project
  compiles against, and servers old enough to lack it don't have spears either.

#297 (armor stands exploding in claims) is covered by the same explosion fix, though
it's addressed through the claim flag path rather than gamerule handling, so it's
worth confirming that matches the original report.

Bukkit/Paper only. The Fabric listener has the same gap but I don't have a way to
test it, so I've left it out rather than guess.

Testing

Verified on a live server: crystal and TNT blasts outside a claim no longer damage
players or armor stands inside it, and spears no longer push armor stands out.
Monster behaviour and normal PvP are unaffected.

Still worth checking before merging.

[noaskers]

These changes are needed for my server as well, so 😄

[WiIIiam278]

I'm not super fond of reflection, but sure, temporarily until cloplib is updated. Would you be interested in a PR to update clop lib to Paper API and do some modern improvements?

[noaskers]

Yeah, I'd definitely be interested in that!

Before I start though, one question: are you happy for ClopLib to become Paper-only, or would you prefer to keep Spigot compatibility where possible? If Paper-only is the plan, is there a minimum Paper version you want to target?

As for the modern improvements, I'm happy to go with whatever you had in mind. The one thing I'd definitely like to include is fixing the getPlayerSource() early return in BukkitEntityDamageListener, since that's the actual cause of the explosion issue. With that fixed, the temporary listener I added in HuskClaims can be removed again.

[noaskers]

I'd also be happy to pick up the existing HuskClaims issues tagged with cloplib change needed while working on it, since those would probably make sense to address alongside the Paper API update.

[WiIIiam278]

If you're up for that, it'd be great. I mean, in principle I'm not opposed to making ClopLib paper only but I think it's possible to maintain spigot back compat by putting this stuff in the paper module and doing some checks :-)

Either way would be better than reflection I think.

[noaskers]

Can you Accept my Discord! @noaskers