JSONML checks childNode instead of the reserved childNodes attribute

[Mahmoodifar]

The reserved-attribute check in JSONML.toJSONObject() checks childNode (singular), although the object representation uses childNodes (plural). As a result, a childNodes attribute is silently overwritten by the element's children, while an ordinary childNode attribute is rejected.

Reproduced on release 20260814 and current master (874673575807723d58bbec9ff1985668742940ce), with Java 17.0.20:

import org.json.JSONML;

System.out.println(JSONML.toJSONObject(
    "<p childNodes=\"metadata\">text</p>", true));
// {"childNodes":["text"],"tagName":"p"} -- attribute lost

System.out.println(JSONML.toJSONObject(
    "<p childNode=\"metadata\">text</p>", true));
// JSONException: Reserved attribute.

Expected: reject childNodes as reserved, as already happens for tagName, and preserve childNode as a regular attribute.

The check is in JSONML.parse(): "tagName".equals(attribute) || "childNode".equals(attribute). Later in the same method, newjo.put("childNodes", newja) overwrites the accepted attribute. Array-form parsing preserves both attribute names, so this affects the object form.