Fix JPMS dependency reads in the JSP, Jakarta, and ESAPI adapters

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Problem and evidence

The explicit descriptors in jsp/src/main/java9/module-info.java, jakarta/src/main/java9/module-info.java, and esapi/src/main/java9/module-info.java require only owasp.encoder. They do not declare reads for their external API dependencies.

Consumer execution on JDK 17 reproduced:

• Loading org.owasp.encoder.tag.ForHtmlTag from the JSP module fails with IllegalAccessError: owasp.encoder.jsp does not read javax.servlet.jsp.api.
• The equivalent Jakarta consumer fails because owasp.encoder.jakarta does not read jakarta.servlet.jsp.
• Calling ESAPIEncoder.getInstance() with the adapter on the module path and ESAPI on the classpath fails because the adapter does not read the unnamed module.

The same failures occur with published 1.4.0. These are pre-existing issues, not regressions introduced by #90. Merely running jar --describe-module does not exercise these linkage failures.

Acceptance criteria

• Determine and document supported module-path dependency arrangements and API versions for each adapter.
• Correct descriptors, including transitive readability where required by exposed public APIs; use real dependency module names verified against the supported artifacts.
• Add isolated named-module consumers that instantiate/use JSP and Jakarta tags and call the ESAPI adapter. Test the two JSP variants separately because they share a package name.
• Positive tests work without broad --add-reads or --add-opens workarounds.
• Retain classpath/container behavior, provided dependency scopes, existing public APIs, Java 8 base bytecode, published automatic-module names, explicit module identities, and OSGi metadata.

Related historical module support discussion: #66.

jsp/src/main/java9/module-info.java、jakarta/src/main/java9/module-info.java、esapi/src/main/java9/module-info.java にある3つの Java 9 ディスクリプタから始め、次に issue に記載された JDK 17 のコンシューマーの失敗を再現します。サポートされている依存関係の構成とモジュール名を検証し、両方の JSP バリアントと ESAPI 用に分離された Named-Module コンシューマーを追加し、広範な read や open の workaround を使わずに module-path の正常系テストを確認します。その際、classpath と公開済みメタデータの動作は維持します。