[IO-893] Rebuild the BOM buffer when resetting without a mark

[jakezwang]

Fixes IO-893.

BOMInputStream eagerly buffers the first bytes in its constructor. Resetting a ByteArrayInputStream before an explicit mark() rewinds the delegate to zero, but previously replayed the old buffer as well, duplicating the prefix and potentially including an excluded BOM.

Rebuild the initial buffer after an implicit reset and preserve the existing buffered-position behavior for explicit marks. Tests cover BOM inclusion/exclusion, no BOM, short input, and repeated resets. A field-specific SpotBugs exclusion reflects the class's documented lack of thread safety.

Validation: default mvn on JDK 21 passed (6,621 tests, 33 skipped), including RAT, API compatibility, Checkstyle, SpotBugs, PMD and Javadoc. All five new regression cases fail without the fix.

• Read the contribution guidelines for this project.
• Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
• I used AI to create any part of, or all of, this pull request. Codex prepared the code, tests and description and ran validation.
• Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body.