Make mvn test work from a clean reactor #140

Problem

A review of main @ 94fd425 (1.4.0) found that mvn test and mvn test-compile fail from a clean reactor: encoder-jsp stops with module not found: owasp.encoder. Core's compile-java-9 execution (pom.xml:262-285, multiReleaseOutput) writes module-info.class to core/target/classes/META-INF/versions/9/, and each adapter descriptor (jsp/src/main/java9/module-info.java:2, jakarta/src/main/java9/module-info.java:2, esapi/src/main/java9/module-info.java:2) declares requires owasp.encoder. For lifecycle invocations before package, Maven's reactor reader hands later modules core/target/classes, where javac cannot see a descriptor stored under META-INF/versions/9. From package onward the reactor resolves core as core/target/encoder-1.4.0.jar, whose META-INF/versions/9/module-info.class javac does read, so the documented mvn package path works.

Evidence

After mvn clean:

mvn -B -ntp -o test-compile
[ERROR] .../jsp/src/main/java9/module-info.java:[2,19] module not found: owasp.encoder

mvn -B -ntp -o test fails the same way on encoder-jsp; mvn -B -ntp -o -DskipTests package succeeds.

Running package once does not help later runs: after a successful package, a fresh mvn test-compile in the same tree still fails, because Maven 3.9's reactor reader hands later modules core/target/classes rather than the existing jar for pre-package phases.

The documented and CI paths are unaffected: README.md "Building" documents only mvn package, and .github/workflows/build.yaml:24,52 run install / verify. PR #98 adds requires transitive and consumer integration tests; it does not change the compile-java-9 execution, and the adapters still requires owasp.encoder.

Impact

Contributors, IDE "compile" actions, and any tooling that stops before package (for example mvn test-compile dependency:analyze) get a misleading "module not found" error for a module that exists in the reactor. No CI step runs mvn test, so a fix stays unprotected until one is added.

Acceptance criteria

• mvn -B -ntp clean test and mvn -B -ntp test-compile succeed from a clean reactor without running package first.
• Core sets project.getArtifact().getFile() before later modules compile, for example with a maven-jar-plugin execution bound to process-classes (after the bundle manifest goal), so the reactor hands adapters the multi-release jar in compile/test invocations.
• The published core/target/encoder-*.jar entry list and OSGi/bnd manifest are unchanged by the fix, compared against a build of main before the change (Make release artifacts reproducible with a recorded reference toolchain #103 tracks the build-time fields that still differ between builds; this change must not conflict with that work).
• The adapters' requires owasp.encoder declarations and all published module names are unchanged.
• CI gains a mvn -B -ntp test step so the property stays protected.
• If the build fix is rejected instead, README.md "Building" (and CONTRIBUTING.md once it exists) state that the reactor must be invoked at package or later and quote the module not found: owasp.encoder error that mvn test / mvn compile produce from a clean tree.

Related: #98, #103

Suggested target: 1.5.0