Fix JPMS dependency reads in the JSP, Jakarta, and ESAPI adapters

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Problem and evidence

The explicit descriptors in jsp/src/main/java9/module-info.java, jakarta/src/main/java9/module-info.java, and esapi/src/main/java9/module-info.java require only owasp.encoder. They do not declare reads for their external API dependencies.

Consumer execution on JDK 17 reproduced:

• Loading org.owasp.encoder.tag.ForHtmlTag from the JSP module fails with IllegalAccessError: owasp.encoder.jsp does not read javax.servlet.jsp.api.
• The equivalent Jakarta consumer fails because owasp.encoder.jakarta does not read jakarta.servlet.jsp.
• Calling ESAPIEncoder.getInstance() with the adapter on the module path and ESAPI on the classpath fails because the adapter does not read the unnamed module.

The same failures occur with published 1.4.0. These are pre-existing issues, not regressions introduced by #90. Merely running jar --describe-module does not exercise these linkage failures.

Acceptance criteria

• Determine and document supported module-path dependency arrangements and API versions for each adapter.
• Correct descriptors, including transitive readability where required by exposed public APIs; use real dependency module names verified against the supported artifacts.
• Add isolated named-module consumers that instantiate/use JSP and Jakarta tags and call the ESAPI adapter. Test the two JSP variants separately because they share a package name.
• Positive tests work without broad --add-reads or --add-opens workarounds.
• Retain classpath/container behavior, provided dependency scopes, existing public APIs, Java 8 base bytecode, published automatic-module names, explicit module identities, and OSGi metadata.

Related historical module support discussion: #66.

Start with the three Java 9 descriptors in jsp/src/main/java9/module-info.java, jakarta/src/main/java9/module-info.java, and esapi/src/main/java9/module-info.java, then reproduce the JDK 17 consumer failures described in the issue. Verify supported dependency arrangements and module names, add isolated named-module consumers for both JSP variants and ESAPI, and confirm positive module-path tests without broad read or open workarounds while preserving classpath and published metadata behavior.