The JCR API jar file is available under the terms of the Day spec license  and the addendum . The essential part of the addendum says:
In addition to the permissions granted under the Specification
License, Day Management AG hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
license to reproduce, publicly display, publicly perform,
sublicense, and distribute unmodified copies of the Content
Repository for Java Technology API (JCR 1.0) Java Archive (JAR)
file ("jcr-1.0.jar") and to make, have made, use, offer to sell,
sell, import, and otherwise transfer said file on its own or
as part of a larger work that makes use of the JCR API.
This is pretty much similar to the
LEGAL-36 case where broad rights are given to redistribute unmodified versions of the file. The consensus seems to be that such dependencies are OK and can be embedded in binaries, but that such unmodifiable files should not be kept in our svn.