Modernize examples to Apache Struts 7.3.0

[lukaszlenart]

Modernizes all 47 example applications to the current Apache Struts 7.3.0 standard.

What changed

Area	Scope
Struts version	7.2.1 → 7.3.0 (parent POM, plus sitemesh3's own override)
Struts config DTDs	54 files → struts-6.5.dtd over https
Validator DTDs	13 files → xwork-validator-1.0.3.dtd over https
Tiles DTDs	7 files → tiles-config_3_0.dtd (unknown-handler was on 2.0)
Maven POM schema	48 POMs → https://maven.apache.org/xsd/maven-4.0.0.xsd
web.xml	29 descriptors migrated to Jakarta EE 6.0; all 47 now current
@StrutsParameter	17 annotations across 7 modules
Naming	"Struts 2" → "Apache Struts" in POM/README prose

The part worth reviewing carefully

struts.parameters.requireAnnotations has defaulted to true since before 7.2.1, so any action missing @StrutsParameter was already silently dropping every submitted parameter. This branch fixes seven such modules:

• crud — getPerson() needed depth = 2 (person.country.countryId)
• shiro-basic — LoginAction.username/password, WelcomeAction.username
• unknown-handler — Login.email/password
• validation-messages — Login.username/password
• bean-validation, themes-override — getPersonBean() needed depth = 1
• mailreader2 — MailreaderSupport: 5 setters + getUser()/getSubscription()

bean-validation was the most misleading of these: with parameters dropped it validated an empty bean, so the demo appeared to work while showing violations unrelated to what the user typed.

Annotations follow what ParametersInterceptor actually inspects — depth 0 on the setter, depth ≥ 1 on the getter — and nested POJOs are deliberately left unannotated, since only the action's root property is authorized.

Verification

• mvn clean test green on JDK 17 and 21 (matching CI)
• xmllint clean across all XML
• Jetty runtime checks confirming nested parameter binding works in crud and still works in the untouched control form-tags
• dependency-check reports 5 CVSS ≥ 7 findings; all are pre-existing — re-running the profile pinned to 7.2.1 reproduces them identically, so the bump introduces none. Left unsuppressed deliberately: suppression is a maintainer's judgment. (The struts2-tiles-plugin hit looks like a CPE false positive — the plugin has no org.apache.tiles dependency.)

Known follow-ups (not addressed here)

• Arrays.asList(getCarModels()) NPEs on the default happy path in form-tags, control-tags, bean-validation, and crud — submit the form without ticking a car model. Pre-existing; worth its own issue.
• The rename covers metadata only; ~104 "Struts 2" strings remain in the JSPs, so page titles a learner sees still say "Struts 2".
• interceptors/pom.xml describes itself as a form-XML-validation example (pre-existing copy-paste).
• basic-struts/README.md intentionally still quotes Welcome To Struts 2! because index.jsp renders exactly that — documentation accuracy over branding consistency.

Design and implementation notes are committed under docs/superpowers/.

🤖 Generated with Claude Code