SONARJAVA-6623 Revert Tomcat 11 upgrade

[vdiez]

Summary

• revert the Tomcat/Jasper 11 migration from Update dependency org.apache.tomcat.embed:tomcat-embed-jasper to v11 #5741
• restore the Tomcat 9 JSP and Java EE compatibility path
• constrain all org.apache.tomcat Maven dependencies to 9.x in Renovate

Why

Tomcat 10 and later use Jakarta APIs, while JSP analysis still relies on the Java EE APIs supplied by Tomcat 9. The follow-up servlet API update in #5792 also fails license generation and would remove the expected javax.servlet classes.

After this merges, Renovate should close #5792 as no longer permitted by the repository configuration.

Verification

• renovate-config-validator .github/renovate.json
• Java 26: mvn clean test -pl java-frontend,java-jsp,sonar-java-plugin -am (13 modules, BUILD SUCCESS)

---

Summary by Gitar

• Refactored internal logic:
  • Replaced autoScanClasspath with globalClasspath in JavaFrontend to ensure consistent classpath usage.
  • Updated JspCodeCheck to identify method invocations using line numbers instead of potentially ambiguous method names.
• Updated dependencies and configuration:
  • Downgraded spring-webmvc to 5.2.3.RELEASE in java-jsp/pom.xml.
  • Added getIeClassId override in JasperOptions to maintain compatibility with legacy JSP configurations.
• Cleaned up tests:
  • Updated JasperTest to point to the correct spring-webmvc-5.2.3.RELEASE.jar test dependency.

_{This will update automatically on new commits.}

[hashicorp-vault-sonar-prod]

SONARJAVA-6623

[gitar-bot]

Code Review ✅ Approved

Reverts the Tomcat 11 migration to restore compatibility with Java EE APIs and Tomcat 9, ensuring stable JSP analysis and license generation. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[aurelien-coet-sonarsource]

LGTM

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube