Build hygiene: normalize text, package module sources, pin serialVersionUID, drop unused test deps

[VolodymyrLinuxovich]

Closes #123.

Build hygiene for batch 04, as four independent commits. BSN declarations are out of scope; #137/#174 already handled them.

1. Line endings, encodings, legacy files (725b80a)

• .gitattributes: LF for text; CRLF only for *.cmd/*.bat (for a future Maven wrapper, Pin Maven bootstrap and toolchain policy; evaluate verified dependency trust separately #122); binary for images and archives. .editorconfig: UTF-8, LF, and indentation for Java, Python and YAML. It deliberately leaves out trim and final-newline rules to avoid churn.
• Line endings: core/pom.xml was the only CRLF text file and is renormalized to LF. With CR ignored, its diff is only the XML declaration line. git ls-files --eol now reports no CRLF or mixed files.
• XML encodings: the ten XML files that declared US-ASCII or ISO-8859-1 (POMs, src/site/site.xml descriptors, checkstyle.xml) now declare UTF-8. All ten are pure ASCII, so only the declaration line changes.
• Legacy manifest: removed the root META-INF/MANIFEST.MF, a stale bnd 1.50 manifest for 1.2.1 that nothing references. The build writes manifests to target/classes.
• Executable bit: cleared on pom.xml, the only executable file. The Python scripts weren't executable, so nothing else changed.
• .gitignore: five overlapping target patterns become one target/.
• The only binary fixture (src/site/resources/images/owasp.jpg) is untouched.

2. Module descriptors in the sources JARs (88ffa45)

• Problem: no sources JAR contained module-info.java. maven-source-plugin packages the project's compile source roots, and src/main/java9 was only a root of the compile-java-9 execution.
• Source root: build-helper-maven-plugin 3.6.2, pinned in pluginManagement, adds src/main/java9 as a project source root.
• Java 8 compile: default-compile now reads only src/main/java, so the descriptor never reaches Java 8 compilation. compile-java-9 is unchanged.
• Javadoc: built at source level 8, so it excludes module-info.java, in both the build and the reporting configuration.
• Binary JARs: unchanged. They still contain only META-INF/versions/9/module-info.class.
• New check: consumers.py prepare now checks that each sources JAR contains module-info.java, its own package's sources, and no class files. All four pass; on main the descriptor was missing from all four.

3. UnsupportedContextException serialization (2d709d4)

• Value: serialver gives -1517019963198920181L for every released core from 1.2 through 1.4.0 (1.2, 1.2.1, 1.2.2, 1.2.3, 1.3.0, 1.3.1 and 1.4.0) and for the current class. That value is now declared explicitly.
• Test: UnsupportedContextExceptionTest pins the value and round-trips an instance.
• Cross-version check (manual): an instance serialized with the released 1.4.0 JAR deserializes with the new class.

4. Unused test dependencies (22757e1)

• Removed: javax.servlet:javax.servlet-api (jsp, test scope) and jakarta.servlet:jakarta.servlet-api (jakarta, test scope). dependency:analyze reports both as unused declared dependencies.
• Evidence: without them, core, jsp and jakarta pass clean verify, including the parameterized tag contracts, the TLD descriptor tests, ModulePathIT and Test every packaged taglib binding through real JSP engines #179's packaged JSP-engine runs.
• Kept: the packaged-consumer harness keeps its own Servlet API JARs in compatibility/dependencies, where the Felix and module-path consumers need them. The optional jakarta-test app is unchanged, per the note about not unifying its newer Servlet stack with the library baselines.
• Core reports jackson-core as a used-but-undeclared test dependency (it comes transitively through jackson-databind). I left it alone because it's not an unused dependency.

Intentionally unchanged

• ESAPI justification property: the fixture's misspelled ESAPI.enableLegCannonModeAndGetMyAssFired.justification= is left as is. The issue says to correct it only if fixture cleanup needs it, and it's empty and untouched here. Unsafe-method opt-ins stay empty and disabled, as testDelegatedSqlEncodingHonorsEsapiPolicy already asserts for ESAPI 2.7.

Verification

Rebased onto main at e6bbebe (#179). Locally on JDK 17:

• mvn clean verify: all modules pass, including Test every packaged taglib binding through real JSP engines #179's Tomcat 9 and Jakarta engine rendering.
• python3 -m unittest discover -s scripts/tests: 10 tests pass.
• consumers.py prepare, including the new sources-JAR check: passes.
• unittest discover -s compatibility/tests: 15 guard tests pass.
• consumers.py run --runtime 17: all four consumers pass on classpath, module path, and Felix R6 and R8.
• scripts/check-taglib-parity.py: 34 files pass.

This is byte-affecting cleanup, so it should land before the final #103 reproducibility baseline, per the issue.

[VolodymyrLinuxovich]

Closing as superseded by #184, which covers #123. Thanks! Keeping UnsupportedContextException's derived serialization identity as it is makes sense to me.

One item from this PR isn't in #184: the two test-scoped Servlet API dependencies, javax.servlet:javax.servlet-api (jsp) and jakarta.servlet:jakarta.servlet-api (jakarta). #184 says none were proven unused. In case it helps, here's what I found:

• dependency:analyze reports both as unused declared dependencies.
• With both removed (commit 22757e1 on this branch), clean verify passes for core, jsp and jakarta. That includes the parameterized tag contracts, the TLD descriptor tests, ModulePathIT, and Test every packaged taglib binding through real JSP engines #179's packaged Tomcat 9 and Jakarta engine runs.
• The harness keeps its own Servlet API JARs in compatibility/dependencies, so the Felix and module-path consumers aren't affected.

If you'd like that removal, I can open a two-file PR against current main. Otherwise, no action needed.