WFLY-14219 moved module.xml files to the latest module namespace as well as cleaned up modules. In the case of the org.jboss.as.security module should keep it's dependency on the javax.api. There could be cases where a provider is used that relies on API's provided by the javax.api module.