TOMEE-4654 - Make the component naming context read-only by default

[jungm]

What

Makes the java:comp component naming context read-only by default, as the Enterprise Beans spec (10.4.4) and EE.5.3.4 require: write attempts against a deployed application's ENC must not take effect.

Why

The IvmContext read-only enforcement already existed and was correct — checkReadOnly() throws OperationNotSupportedException and setReadOnly() cascades through the whole name tree. But nothing ever turned it on: openejb.forceReadOnlyAppNamingContext defaulted to false, so every deployed application got a fully writable java:comp, letting bind/rebind/rename through where the spec requires them refused.

Changes

• Assembler: default openejb.forceReadOnlyAppNamingContext to true (kept as an explicit opt-out for anyone depending on the old writable behaviour).
• Assembler.setAppNamingContextReadOnly: also mark the WebContext and AppContext naming contexts read-only. Servlets and JSF managed beans resolve java:comp/java:module/java:app through those contexts rather than through a BeanContext, so marking only the BeanContexts left the web tier writable. The one late write to the app context (app/BeanManager) happens before this point, so it is unaffected.
• JavaCompReadOnlyTest (new): deploys a real application and asserts bind/rebind/rename/unbind/createSubcontext/destroySubcontext are all refused on java:comp and java:app, that nothing written becomes observable, and that pre-existing bindings survive.
• AppNamingReadOnlyTest: inverted testAppNamingContextWritableByDefault (it asserted the exact bug) into a read-only-by-default test, plus a separate test for the opt-out path.

Verification

• openejb-core full suite: 4093 tests, the only 6 failures are pre-existing security-test failures reproduced on a clean main (unrelated to this change).
• Jakarta EE 11 Web Profile TCK enterprise-beans-30 partition against a freshly built Plume distribution: the naming/context write assertions now pass in both the EJB and web (servlet / filtered-servlet / JSF) vehicles.

Reviewer notes

• This is a container-wide default change. An application that writes to its own ENC after deployment would now be refused; the property above restores the old behaviour if needed.
• The TCK harness change to un-exclude these tests lives in the separate apache/tomee-tck repo and is not part of this PR.
• The TCK run surfaced a separate, pre-existing read-side bug (filed as TOMEE-4658): in web components TomEE hands out Tomcat's org.apache.naming.NamingContext instead of IvmContext, so java:comp/env lists extra comp/module entries and close() fails. It is orthogonal to this read-only fix and not addressed here.

🤖 Generated with Claude Code