The component file jetspeed-security-*.jar contains in its META-INF/ directory two *.xml files. These files prevent the deployment of this Jar in JBoss in other contexts than a WAR.
The reason is that JBoss assumes that there is a special deployer for Jars that have .xml files in META-INF. So the default deployer for Jars skips any such Jars. This problem does not show if jakarta-security-.jar is put in the WEB-INF/lib simply because you cannot use the JBoss deployer for Jetspeed2 anyway, you must use the Tomcat deployer. but if you try to put jetspeed-security-*.jar in e.g. a sar, the problem shows.
As far as I have understood, the *.xml files are only significant for testing anyway. They should be put elsewhere.
I'm aware that this is, at its root, a JBoss problem. But I won't be able to make them change this behaviour.