Note Jakarta EE issues in new README.md section.

Added new prominent section in the README.md file to display a message about the problems of trying to refer use application containers or libraries that use Jakarta EE's jakarta.servlet-api.

The intent is to get some relief from people creating new GitHut issues or sending the ESAPI devs emails.

Author: kwwall

README.md

@@ -14,6 +14,19 @@ OWASP® ESAPI (The OWASP Enterprise Security API) is a free, open source, web ap
 </tr>
 </table>
 
+# Special note regarding Spring Boot 3, Spring 6, Tomcat 10 and other applications / libraries requiring Jakarta EE
+<table border=<5>
+<tr>
+<td>
+<b>IMPORTANT:</b> We are aware that all versions of ESAPI (unless you are using very select parts) do not work with Jakarta EE. Jakarta EE relies on <b>jakarta.servlet-api</b>. ESAPI is built to use <b>javax.servlet-api</b>. This causes things like Spring Boot 3, Spring 6, Tomcat 10, the latest version of Jetty, etc. to fail to load certain (well, many) ESAPI classes. The reason for this is that the package names between these 2 libraryes are different! The dependency <b>javax.servlet-api</b> has a package namespace of <code>javax.servlet</code>. The <b>jakarta.servlet-api</b> library is using the package namespace of <code>jakarta.servlet</code>. So references to things like <code>ServletRequest</code>, <code>ServletResponse</code>, etc. in ESAPI are using <code>javax.servlet.ServletRequest</code> and <code>javax.servlet.ServletResponse</code> respectively. We cannot make it work for both at once and we will not stop supporting <b>javax.servlet-api</b>, which is what most of our existing ESAPI clients are using.
+<p>
+Therefore <b>PLEASE STOP</b> sending us emails and/or creating GitHub issues regarding this! Instead, please
+read ongoing the GitHub discussion https://github.com/ESAPI/esapi-java-legacy/discussions/768 for further details.
+</p>
+</td>
+</tr>
+</table>
+
 # A word about ESAPI vulnerabilities
 A summary of all the vulnerabilities that we have written about in either the
 ESAPI Security Bulletins or in the GitHub Security Advisories may be found