Migrate from arquillian-glassfish-server-managed to arquillian-glassfish-server-pool

[BalusC]

Replaces the per-module GlassFish unpack + JVM-scoped server lifecycle with a shared pre-warmed slot pool, mirroring the faces/tck migration in jakartaee/faces#2165. A single GlassFish dist is unpacked at validate, all slots clone from it, and the arquillian-glassfish-server-pool extension leases a slot per test JVM. Default invocation is unchanged (mvn verify); mvn clean install -T8 drops wall-clock from ~24 min to ~2 min.

• glassfish-pool-maven-plugin in pluginManagement carries distribution + per-overlay (jakarta.security-api, soteria, soteria-weld) config; per- overlay tags wire to the existing security.api.update / soteria.update master switches via a build-helper bsh-property hop.
• glassfish-ci-managed profile rewritten: arquillian-glassfish-server-pool
  in place of -managed, pool:up at initialize, parent-owned source-staging
  antrun at validate (mkdir-lock + marker, awk-portable) handles unpack, Mitre cert import into cacerts.p12, and trustStorePassword injection into domain.xml — see the in-line comment on gf.pool.unpack.skip for why these have to land before pool:up.
• maven-install-plugin install-file (vendor-api jar for sigtest) is now inherited=false at initialize on the reactor root only — aggregator goal with a per-module execution wasn't safe under -T.
• maven-surefire-report-plugin failsafe-report-only and cyclonedx makeAggregateBom: same root-only treatment, removes the parallel-build aggregator stalls.

Shared-pool collateral fixed alongside (each came up while making individual modules -T-safe; README's "Running tests in parallel" section documents the rules for new modules):

• Cross-app java:global/ DataSource sharing exposed an upstream GlassFish bug — ComponentEnvManagerImpl.getResourceId returned "" for ScopeType.GLOBAL, so every app declaring the same java:global/X ended up sharing one un-prefixed physical pool, and connections opened against the first app's classloader lingered after that app undeployed (next app's lookups blew up with ClassLoader is not in expected state wrapped as SQLException: GeneralError). Fixed in Scope java:global/ resource pools per declaring app eclipse-ee4j/glassfish#26029
• Per-module embedded LDAP ports: app-ldap2/3 split off the colliding 33389 onto 33390/33391; app-ldap stays on 33389.
• app-openid: hardcoded http://localhost:8080/openid-server/... replaced with EL/UriInfo-derived URLs (OpenIdConfig.getProviderURI() backed by injected HttpServletRequest; OidcProvider uses @context UriInfo) so metadata, JWT issuer and providerURI all track the live request.
• app-openid2/3: per-module Tomcat ports (8443+8005 / 8444+8006); clients.sql redirect URIs pre-registered for every slot the pool may grow to (= ${session.request.degreeOfConcurrency} = -TN, exposed as a regular property via bsh-property since Maven only resolves bean expressions for typed Plexus parameters); openid3 cert pair refreshed (the original expired 2023-03 and PKIX rejects it on a current JDK); Tomcat work/ wiped before startup so SESSIONS.ser doesn't resurrect Mitre's "client already authorized" state across re-runs without clean.
• arquillian.xml: glassfish-pool container added (default), poolDir from the gf.pool.dir property forwarded by failsafe.

The Mitre cert handling needed two pre-startup fixes: the cert must be in cacerts.p12 before GF starts (Java caches the default SSLContext on first SSL use and never reloads from disk), and -Djavax.net.ssl.trustStorePassword must be set on the GF JVM — without it Java loads the PKCS12 truststore with zero trust anchors regardless of how many certs the file contains. The cert import runs from antrun (it's TCK-specific). The trust-store password goes through arquillian-glassfish-server-pool's native hook (added in OmniFish-EE/arquillian-container-glassfish#39 to mirror the existing glassfish-managed convention), which bakes it into each slot's domain.xml as a -D jvm-option at provisioning time.

NOTE: this is a Draft PR because arquillian-container-glassfish 2.1.4 is not yet released and 2.1.4-SNAPSHOT in current code needs to be swapped out for 2.1.4 or 2.2.0 once it's released.

Related PR: OmniFish-EE/arquillian-container-glassfish#38
Checkout both branches, make sure eclipse-ee4j/glassfish#26029 is fixed in your local GlassFish 9.0.0-SNAPSHOT, build the arquillian-container-glassfish 2.1.4-SNAPSHOT then run mvn clean install -Tn on tck folder of current branch.

Fastest result so far at my machine using mvn clean install -T8:

[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  01:49 min (Wall Clock)
[INFO] Finished at: 2026-05-11T09:32:31-04:00
[INFO] ------------------------------------------------------------------------

It was ~24 minutes.