Fix JPMS dependency reads in the JSP, Jakarta, and ESAPI adapters

Follow-up to #90 (reviewed at 31588e1). This tracks work intentionally kept separate from the modernization PR.

Problem and evidence

The explicit descriptors in jsp/src/main/java9/module-info.java, jakarta/src/main/java9/module-info.java, and esapi/src/main/java9/module-info.java require only owasp.encoder. They do not declare reads for their external API dependencies.

Consumer execution on JDK 17 reproduced:

• Loading org.owasp.encoder.tag.ForHtmlTag from the JSP module fails with IllegalAccessError: owasp.encoder.jsp does not read javax.servlet.jsp.api.
• The equivalent Jakarta consumer fails because owasp.encoder.jakarta does not read jakarta.servlet.jsp.
• Calling ESAPIEncoder.getInstance() with the adapter on the module path and ESAPI on the classpath fails because the adapter does not read the unnamed module.

The same failures occur with published 1.4.0. These are pre-existing issues, not regressions introduced by #90. Merely running jar --describe-module does not exercise these linkage failures.

Acceptance criteria

• Determine and document supported module-path dependency arrangements and API versions for each adapter.
• Correct descriptors, including transitive readability where required by exposed public APIs; use real dependency module names verified against the supported artifacts.
• Add isolated named-module consumers that instantiate/use JSP and Jakarta tags and call the ESAPI adapter. Test the two JSP variants separately because they share a package name.
• Positive tests work without broad --add-reads or --add-opens workarounds.
• Retain classpath/container behavior, provided dependency scopes, existing public APIs, Java 8 base bytecode, published automatic-module names, explicit module identities, and OSGi metadata.

Related historical module support discussion: #66.

从 jsp/src/main/java9/module-info.java、jakarta/src/main/java9/module-info.java 和 esapi/src/main/java9/module-info.java 中的三个 Java 9 描述符开始，然后复现 issue 中描述的 JDK 17 consumer 失败。验证受支持的依赖安排和模块名称，为两个 JSP 变体及 ESAPI 添加隔离的 Named-Module consumer，并确认不使用广泛的 read 或 open workaround 的正向 module-path 测试，同时保留 classpath 和已发布元数据的行为。