[improve][misc] PIP-472: Migrate from javax.* to jakarta.* APIs

[lhotari]

PIP: PIP-472

Motivation

Implements PIP-472: Migrate from javax.* to jakarta.* APIs.

The upstream ecosystem (Jersey 3.x, Jetty 11+/12 ee10, Swagger Core 2.x, Spring 6, Hibernate Validator 7+)
requires the jakarta.* namespace. Pulsar was in a half-migrated state: Jetty 12 was wired through its ee8
(Servlet 4 / javax.servlet) compatibility modules, Jersey was pinned at 2.x (javax.ws.rs), and the
jakarta.*-named API artifacts were pinned to Jakarta EE 8 versions that still ship the javax.* packages.
This change completes the namespace migration so Pulsar 5.0 LTS ships on clean Jakarta APIs.

Modifications

Dependencies (gradle/libs.versions.toml)

• Jersey 2.42 → 3.1.10; jakarta.ws.rs-api 2.1.6 → 3.1.0; jakarta.annotation-api → 2.1.1;
  jakarta.xml.bind-api → 4.0.2; jakarta.validation-api → 3.0.2; jakarta.activation-api → 2.1.3
  (impl switched to org.eclipse.angus:angus-activation, the EE10 reference impl).
• Added jetty-ee10-* aliases alongside the retained jetty-ee8-*; added jakarta.servlet:jakarta.servlet-api:6.0.0
  alongside the retained javax.servlet:javax.servlet-api:3.1.0.
• jackson-jaxrs-json-provider → jackson-jakarta-rs-json-provider; Prometheus simpleclient_servlet →
  simpleclient_servlet_jakarta.

Source migration

• javax.ws.rs.* → jakarta.ws.rs.* (169 files); broker/proxy/websocket/functions-worker REST tier on Jersey 3.
• javax.servlet.* → jakarta.servlet.* for Pulsar's own code; Jetty wiring (WebService, WebServer,
  websocket ProxyServer, functions WorkerServer) moved from ee8 to ee10 (removed the .get() core-Handler
  bridges; ee8.nested.Request.getBaseRequest(...) → ServletContextRequest-based connector lookup).
• WebSocket endpoints migrated to Jetty 12's native WebSocket API
  (org.eclipse.jetty.websocket.api.Session.Listener / Callback).

AdditionalServlet plugin SPI (backward compatible)

• Added AdditionalServletType.JAKARTA_SERVLET. The broker (PulsarService/WebService) and proxy
  (ProxyServiceStarter/WebServer) now route JAKARTA_SERVLET handlers to Jetty's ee10 environment and keep
  routing legacy JAVAX_SERVLET handlers to the retained ee8 environment, so existing javax.servlet plugins
  keep working without recompilation. Both environments coexist on the same Jetty server.

Shading / packaging

• pulsar.client-shade-conventions and localrun-shaded relocations updated javax.* → jakarta.*; renamed the
  checked-in META-INF/services/org.apache.pulsar.shade.javax.ws.rs.* provider files to ...jakarta.ws.rs.*.

Swagger 1.x → Swagger Core 2.x is deferred to a follow-up (it is io.swagger, compile-/doc-only, and decoupled
from the namespace move); Swagger stays at 1.6.2 in this change.

Third-party javax.* that intentionally remains (not Pulsar's own code — kept available where third-party libs
still reference the legacy packages):

• The tiered-storage offloaders (jclouds 2.6.0 and Hadoop MiniDFSCluster) still reference legacy javax.xml.bind,
  javax.ws.rs, javax.annotation and javax.validation; these are restored as runtime-/test-scoped deps, and the
  file-system offloader test classpath is pinned to the legacy javax web stack (Jetty 9 / Jersey 2.46 / hk2 2.6.1).
• async-http-client (the pulsar-client-admin HTTP client) pulls com.sun.activation:jakarta.activation:1.2.2
  (the legacy javax.activation impl, for multipart MIME-type detection), so it remains bundled.
• Athenz needs no change: current master ships Athenz 1.12.42, which already uses jakarta.xml.bind
  (athenz-auth-core pulls org.glassfish.jaxb:jaxb-runtime:4.0.8).

Verifying this change

• Make sure that the change passes the CI checks.

This change is already covered by existing tests: the broker / proxy / client REST, servlet, websocket, broker
interceptor, transaction, function, and tiered-storage suites exercise the migrated Jetty 12 ee10 / Jersey 3 stack
end-to-end. A full green CI run on the author's fork (lhotari/pulsar) covered 39/39 jobs — Build & License,
all Broker unit groups (1–5), Client API/Impl, and the System/integration suites (including the broker-interceptor
and tiered-storage offloader suites). spotlessCheck + checkstyleMain + checkstyleTest pass locally.

A few Jetty 12 ee10 / Jersey 3 runtime issues surfaced during the migration and are fixed here:

• Ambiguous-URI 400s for %2F-encoded topic names — ServletHandler.setDecodeAmbiguousURIs(true) on the
  ee10 servlet handlers (broker / proxy / functions-worker).
• Broker-interceptor "Trailing token" 400s — RequestWrapper.getInputStream() returned a fresh stream per
  call, so the ee10 / Jersey entity reader re-read the body's leading { after EOF as a phantom trailing token;
  fixed by returning a single, Servlet-contract-compliant cached stream with lazy, Content-Length-bounded buffering.
• Tiered-storage offloader classpaths — restored the legacy javax EE APIs that jclouds / Hadoop need (see
  Modifications above).

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency) — Jersey 2→3, Jetty ee8→ee10, the jakarta API bumps, the Jackson
  JAX-RS provider, and the activation impl (Angus); see Modifications.
• The public API — JAX-RS / Bean-Validation annotations on the published pulsar-client-admin REST DTOs move to
  jakarta.*, and the AdditionalServlet SPI gains AdditionalServletType.JAKARTA_SERVLET. Auth / REST plugins
  must recompile against jakarta.*; existing javax.servlet AdditionalServlet plugins remain binary-compatible.
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints (URLs / request bodies / status codes are unchanged)
• The admin CLI options
• The metrics
• Anything that affects deployment