migrated to PMD5

First attemp to migrate to PMD5.
At least it works for simple cases.

As addittion, it considers String method params as tainted sources.