Transitive module dependences not matching dependencies in POM

With 4278cc1 (#299), `jakarta.security` `requires transitive` `jakarta.servlet`, `jakarta.security.auth.message` and `jakarta.json`. While the Maven artifact providing `jakarta.json` (`jakarta.json:jakarta.json-api`) has `compile`, the artifacts providing the two other modules (`jakarta.servlet:jakarta.servlet-api`, `jakarta.authentication:jakarta.authentication-api`) have `provided`.

The latter therefore are not transitive dependencies of a Maven project with dependency `jakarta.security.enterprise:jakarta.security.enterprise-api` (see table in [Maven docs](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#dependency-scope)).

As a consequence, if the Maven project defines a module which `requires jakarta.security`, it has [implicit dependences](https://docs.oracle.com/javase/specs/jls/se21/html/jls-7.html#jls-7.7.1) on `jakarta.servlet`, `jakarta.security.auth.message` and `jakarta.json`, but only `jakarta.json` is provided by a transitive dependency.

Therefore, the build fails with e.g. "module not found: jakarta.security.auth.message", if there is no direct dependency on `jakarta.authentication:jakarta.authentication-api`, regardless of whether this dependency is actually used.

Example:
A Maven project with
```

jakarta.servlet
jakarta.servlet-api
6.1.0


jakarta.security.enterprise
jakarta.security.enterprise-api
4.0.0

```
provides all necessary classes for e.g.
```
public class TestAuthentication implements HttpAuthenticationMechanism {
@Override
public AuthenticationStatus validateRequest(
HttpServletRequest httpRequest,
HttpServletResponse httpResponse,
HttpMessageContext ctx
) throws AuthenticationException {
return ctx.doNothing();
}
}

```
If this is packaged into a module
```
module test {
requires jakarta.security;
requires jakarta.servlet;
}
```
building fails as described above.

As a work-around, an unused dependency has to be declared:
```

jakarta.authentication
jakarta.authentication-api
3.1.0

```

Start by inspecting the Maven POM dependency declarations for the Jakarta Security API modules and compare their scopes with the JPMS transitive requirements described in the issue. Reproduce the example with a module requiring jakarta.security and jakarta.servlet; done means the needed jakarta.servlet and jakarta.security.auth.message modules are available transitively without an unused direct dependency.

Written by the indexing model from the issue text.