Remove Restlet: migrate `/oauth2`, `/uma`, `/xacml` and `/.well-known` to the ForgeRock CHF stack

[maximthomas]

Problem

OpenAM still serves four URL areas on Restlet 2.4.4: /oauth2/* (all OAuth2/OIDC
protocol endpoints), /uma/*, /xacml/* and /.well-known/* (WebFinger). About 105
production Java files import org.restlet.

Restlet is abandoned upstream and never shipped a Jakarta release, so this repo carries:

• a vendored jakarta-transformed fork — transform-jakarta/restlet-parent-jakarta/
  (5 submodules, Eclipse Transformer rewriting org.restlet.jee:*:2.4.4 bytecode), and
• a hand-ported servlet bridge module openam-restlet
  (ServerServlet, ServletCall, ServletWarClient, …).

Every JDK/servlet bump has to be absorbed by code we maintain ourselves for a dead
framework. Meanwhile the rest of the REST surface (/json, /frrest, REST STS) already
runs on CHF (org.forgerock.http) + CREST; RestletRealmRouter is @Deprecated in
favour of CHF's RealmRoutingFactory, and openam-rest/pom.xml still carries the comment
"TODO required until Restlet endpoints are moved to CHF". CHF is the codebase's own
declared target — this issue finishes the job.

Goal

Full removal of Restlet from OpenAM: server endpoints, the outbound scripting HTTP
client, vestigial imports, then deletion of openam-restlet and the vendored fork.

Done when:

• grep -rn "org.restlet" --include="*.java" . → 0 hits
• grep -rn restlet --include=pom.xml . → 0 hits
• mvn clean install green; mvn -pl openam-server verify -P integration-test green
• manual smoke of the full OAuth2/OIDC/UMA/XACML matrix against a running WAR

Approach (locked decisions)

• Target stack: CHF Handlers via the existing HttpRouteProvider SPI and
  Endpoints.from annotated POJOs. Rejected: JAX-RS/Jersey (duplicates realm/audit/version
  infra, second modern stack), plain servlets (boilerplate), Spring MVC (foreign stack).
• Strategy: incremental strangler — one endpoint area per phase, each phase a
  shippable green commit.
• Cutover lever: the OpenAM HttpFrameworkServlet uses routing-base=context_path,
  so an area moves by (a) adding an HttpRouteProvider for its leading path segment +
  META-INF/services registration, and (b) moving its <servlet-mapping> from
  ForgeRockRest to OpenAM in openam-server-only/src/main/webapp/WEB-INF/web.xml.
• New-class convention: classes authored by this migration live under
  org.openidentityplatform.openam.<area>, CDDL header with Copyright 2026 3A Systems LLC.,
  no @since. Classes modified in place keep their package/header.