Fix launch/app resolve for Jetty 12 / Jersey JAX-RS whiteboard migration

openhab-core's Karaf 4.5 / Jetty 12 migration (Jersey-based JAX-RS
whiteboard, JAXB 4.0, Jakarta Servlet 6.1) left launch/app/app.bndrun
unable to resolve. Several issues compounded:

- org.apache.aries.jax.rs.whiteboard was replaced with the Jersey-based
  org.eclipse.osgitech.rest triplet, matching openhab-core's own
  itest bndruns.
- -runrequires.ee updated for the JAXB 4 stack (jakarta.activation-api,
  org.glassfish.jaxb.{core,runtime,txw2}, com.sun.istack.commons-runtime)
  instead of the old servicemix activation-api.
- swagger-core-jakarta hard-requires jakarta.xml.bind.annotation in range
  [3.0,4), which nothing provides once bom/runtime moved to JAXB 4.0.5.
  Repository construction was switched from bnd-run-maven-plugin's live
  Maven-dependency-graph resolution (which can only ever expose one
  version per artifact) to bnd-indexer-maven-plugin building its own
  index + a small frozen jaxb3-compat-index.xml, wired in via
  -standalone - the same technique openhab-core's bom/runtime-index /
  bom/openhab-core-index pair uses, so swagger gets a 3.0.0 candidate
  alongside the real 4.0.5 used everywhere else.
- org.apache.felix.http.servlet-api and org.apache.tomcat-servlet-api
  are stale/duplicate providers of jakarta.servlet and javax.servlet
  (5 distinct bundles exported the same heavily "uses"-referenced
  packages); this ambiguity was driving Felix's resolver into
  exponential backtracking (confirmed via thread dump) whenever enough
  of the feature set was requested together, most visibly with
  org.eclipse.osgitech.rest and org.apache.felix.webconsole.plugins.ds.
  Blacklisting both fixes the resolve; org.ops4j.pax.web.pax-web-
  compatibility-servlet is deliberately kept off the blacklist since
  it's the real bridge providing the osgi.contract=JakartaServlet
  capability at both 5.0.0 (needed by osgitech.rest, pinned to Jakarta
  Servlet 5.0) and 6.1.0 (needed by pax-web-runtime on Jetty 12).
- jakarta.ws.rs-api is no longer blacklisted, since it's required by
  the Jersey-based stack.

The org.apache.felix.webconsole 4.8.12 -> 5.0.18 bump and the
org.owasp.encoder dependency it needs live in openhab-core's
bom/runtime, not this repo.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Holger Friedrich <mail@holger-friedrich.de>

Author: holgerfriedrich