Three Jakarta EE 9.1 SecurityAPI TCK tests are failing on JDK11 + JDK17

@testName: testFormHAMValidateRequest
@assertion_ids: Security:JAVADOC:24; Security:JAVADOC:80;Security:SPEC:2.4-2; Security:SPEC:2.4-5;
@test_Strategy: 1. Send request to access protected servlet 2. Receive login page(make sure it the expected login page) 3. Send form response with username and password 4. Receive protected servlet (ensure principal is correct, and ensure getRemoteUser() returns the username, and ensure isUserInRole() is working properly)

@testName: testCustomFormHAMValidateRequest
@assertion_ids: Security:JAVADOC:24; Security:JAVADOC:79;Security:SPEC:2.4-3; Security:SPEC:2.4-5;
@test_Strategy: 1. Send request to access protected servlet 2. Receive login page(make sure it the expected login page) 3. Send form response with username and password 4. Receive protected servlet (ensure principal iscorrect, and ensure getRemoteUser() returns the username, and ensure isUserInRole() is working properly)

@testName: testAutoApplySession
@assertion_ids: Security:SPEC:2.4.6-1
@test_Strategy: Access protected servlet with credential and rememberme=true, then the next call can access the servlet without credential and rememberme until logout.