[Clarification] web.xml context-param PolicyConfigurationFactory.provider

I was looking for the best mailing list to use but I see the one associated with the spec has 0 subscribers so will start with an issue, https://accounts.eclipse.org/mailing-list/jacc-dev. I can move elsewhere if we have a more appropriate location.

I wanted to start a discussion regarding the expected behaviour of setting `jakarta.security.jacc.PolicyConfigurationFactory.provider` in a web.xml context param.

This relates to changes introduced in https://github.com/jakartaee/authorization/pull/160.

For other types such as the Policy we are able to obtain instances specific to a web application by using the unique contextId of the application allowing each application to have their own registered implementation.

The PolicyConfigurationFactory API is however built around a singleton registration so calling setPolicyConfigurationFactory is JVM wide. Previously it was only possible to set the PolicyConfigurationFactory via the API directly or via a system property.

As this can now be set with a context-param in a web.xml I wanted to raise this discussion to understand the expected interaction if multiple web applications are deployed and what the scoping mechanism should be.

As it stands it feels that if multiple web applications define this context param unpredictable behaviour may result if these applications are deployed and undeployed independently.

Read the PolicyConfigurationFactory API and the changes in PR 160, then inspect how the web.xml context-param is handled. Determine the expected behavior when multiple web applications set the parameter, including its scope and lifecycle, and capture an agreed resolution for the specification or implementation.

Written by the indexing model from the issue text.