fix(deps): declare activemq-jaas explicitly (broker declares it as optional)

[natechadwick-intsof]

Summary

activemq-broker-5.16.8.pom declares activemq-jaas as <optional>true</optional>, so Maven never pulls it in transitively. The org.apache.activemq.jaas.GroupPrincipal class lives in activemq-jaas-5.16.8.jar (not in activemq-broker-5.16.8.jar), so as soon as the SimpleAuthenticationPlugin(List<?>) constructor is exercised, the JVM throws:

NoClassDefFoundError: org/apache/activemq/jaas/GroupPrincipal

This was a latent issue under the T2.2 hardening (#166) — the <simpleAuthenticationPlugin anonymousAccessAllowed="false"/> block didn't actually call the List constructor (it constructed the plugin with the no-arg ctor, which doesn't reference GroupPrincipal), so the missing class was never observed. PR #215 changed the config to <users><authenticationUser .../></users>, which forces the List ctor, which surfaces the missing class. So the regression is a followup of #215, not of the original T2.2 PR.

The WebUI module's pom declares dependencies on activemq-broker, activemq-client, activemq-kahadb-store, activemq-spring, activemq-jms-pool — but not activemq-jaas. The root pom's dependencyManagement block is missing activemq-jaas too. Maven respects <optional>true</optional> and does not transitively include optional deps, so the jar is never resolved, downloaded, or copied to WEB-INF/lib/.

Plan

1. Add activemq-jaas to the root pom.xml dependencyManagement block (next to the other activemq entries, alphabetically before commons-digester).
2. Add activemq-jaas to WebUI/pom.xml as a runtime dependency (next to the other activemq entries, alphabetically before spring-core).
3. Branch bugfix/<this-issue>-activemq-jaas-dep; commit, GPG-sign, push, open PR.
4. Manually copy activemq-jaas-5.16.8.jar (downloaded from Maven Central) into the install at ~/installs/cms-818/jetty/base/webapps/Rhythmyx/WEB-INF/lib/ so the user can restart and verify the fix without waiting for a rebuild.

Verification

• After the rebuilt WAR/EAR is deployed (or with the manually-copied jar):
  • grep -c "NoClassDefFoundError" .../server.log — 0
  • grep -c "Failed to load: class path resource \[activemq.xml\]" ... — 0
  • grep -c "Could not refresh JMS Connection" ... — 0 (steady state)
  • unzip -l WebUI/target/.../WEB-INF/lib/activemq-jaas-5.16.8.jar | grep GroupPrincipal — present

Co-Authored by Mavis Mavis-Code using MiniMax-M3 with agent mavis.