Modernize build, CI, packaging, and documentation

[jmanico]

Summary

• update the build-critical Maven plugins, JUnit, JaCoCo, Surefire, Failsafe, and Felix tooling
• replace Spring-based JSP test mocks with minimal local JSP contexts and writers, removing the two vulnerable spring-core dependency paths reported for GHSA-659m-px2c-25wj
• preserve Java 8 bytecode, published automatic module names, and explicit JPMS identities while excluding multi-release internals from OSGi exports
• make Javadoc failures actionable and repair invalid HTML in the API documentation
• update GitHub Actions majors, enable Maven caching, and reduce Maven transfer noise
• refresh Maven Central, OWASP, build, release, module, Jakarta taglib, and security-policy documentation

Review fixes

• Restore all four published Automatic-Module-Name values (org.owasp.encoder, org.owasp.encoder.jsp, org.owasp.encoder.jakarta, and org.owasp.encoder.esapi). Keep these manifest names independent of the unchanged explicit JPMS descriptors (owasp.encoder...), retain the legacy jigsaw.module.name Maven configuration property, and document the distinction.
• Add packaged-core regression tests for the manifest header, automatic-module discovery with multi-release support disabled, and explicit-module discovery with it enabled. The manifest/fallback tests fail before this fix and pass afterward.
• Restore OSGi R6 compatibility with Bnd's _noimportjava instruction. All four published bundles now omit the java.* imports that older frameworks reject.
• Add a Failsafe integration test that installs and starts the packaged encoder JAR in Felix 5.6.12, then calls the encoder through the bundle's classloader. Felix is deliberately pinned to an OSGi R6 version as a test-only fixture, not a runtime dependency.
• Update the optional Jakarta test application to Spring Boot 3.5.16, which resolves Spring Framework 6.2.19, addressing the remaining test-app dependency affected by CVE-2026-41848.
• Remove conflicting dependency pins so Boot manages compatible Tomcat, JSTL, Testcontainers, and Selenium versions. Remove the duplicate Spring Boot repackage execution inherited from the parent.

Validation

• mvn -B -ntp clean verify with Homebrew OpenJDK 17 and Maven 3.9.16: 1,147 tests passed with no failures, errors, or skips.
• Confirmed the new OSGi test fails before the manifest fix with Importing java.* packages not allowed: java.io, then passes with the fix.
• The Jakarta application startup test passed locally with the upgraded dependencies, and the WAR packaged successfully. Docker is unavailable locally, so the browser test is validated in CI.
• CI passed on commit 31588e1: mvn -B -ntp install -PtestJakarta ran all 1,149 tests, including module-metadata regression tests, OSGi compatibility, and the Docker/Selenium browser test, with no failures, errors, or skips.
• Dependency-tree and packaged-WAR checks confirm Spring 6.2.19 and aligned Tomcat 10.1.55 artifacts. The library modules have no Spring dependency, and the legacy Felix fixture is test-scoped only.
• Compared all four rebuilt JARs with published 1.4.0: all 64 class files (including explicit JPMS descriptors) are byte-identical; all automatic module names, OSGi identities, and dependency imports are preserved. Base bytecode remains Java 8.
• Core consumer execution passed using both automatic-module fallback and explicit JPMS discovery on JDK 11, 17, 21, and 25.
• actionlint .github/workflows/build.yaml, XML validation for every POM and src/site/site.xml, and whitespace checks respecting the existing CRLF convention in core/pom.xml.

Follow-ups intentionally left out

• The JSP, Jakarta, and ESAPI explicit module descriptors still lack reads for their external API dependencies. Module-path adapter use fails on both published 1.4.0 and this branch; correcting this pre-existing issue needs a separate change with consumer-execution tests.
• mvn site still fails in the legacy Maven Site 3.4/Reflow/Doxia stack. Since gh-pages is only a redirect to the OWASP project page, retiring that machinery may be preferable to upgrading it.
• Central release tooling, the ESAPI version range, CodeQL setup, and a broader JDK matrix remain focused follow-up work.
• Spring Boot 3.5.16 is the final open-source 3.5 release. A future major-version migration of the optional test application is separate from this dependency patch, which preserves its current Servlet 6 baseline.

[jeremylong]

LGTM