…r/; trim dead libs

Problem: uPortal core's skin descriptors and admin JSPs were the
largest fleet-wide consumer of legacy /ResourceServingWebapp/...
paths and a bundle of 2008-2015 utility libraries (lodash 4.17.4,
modernizr 2.6.2, normalize.css 2.1.2, four polyfill webjars). Most
of those libs are either CVE-prone, native-replaceable on modern
browsers, or both. The <rs:compressJs> JSP tag the admin pages used
is already a no-op upstream (the resource-server-utils maintainers
deprecated it; minification moved to esbuild) — its presence in the
markup is dead weight. Tango and famfamfam icon URLs across the
admin chrome and skin SCSS still pointed at the legacy WAR.

Goal: move every legacy /ResourceServingWebapp/ reference to the
modern /resource-server/ context, drop libraries that no consumer
needs, and remove the dead taglib wrappers — ahead of the legacy
overlay being retired from uPortal-start.

Changes:
- uPortal-webapp/src/main/webapp/WEB-INF/jsp/Search/{search,searchLauncher,searchRest}.jsp,
  WEB-INF/jsp/Translator/translator.jsp,
  WEB-INF/jsp/SessionTimeout/header.jsp,
  WEB-INF/jsp/DynamicRespondrSkin/skinConfig.jsp,
  WEB-INF/jsp/Statistics/reportGraph.jsp: remove the no-op
  <rs:compressJs>...</rs:compressJs> wrappers around inline <script>
  bodies. Indentation preserved.
- uPortal-webapp/src/main/webapp/WEB-INF/jsp/Search/searchRest.jsp,
  WEB-INF/jsp/Invoker/sitemap.jsp: drop the lodash 4.17.4 <script>
  tag (CVE-2018-3721, CVE-2019-10744, CVE-2020-8203, CVE-2021-23337).
  Rewrite 12 _.forEach/_.startCase/_.kebabCase/_.has/_.every/
  _.unescape/_.forOwn callsites to native ES (Object.keys+forEach,
  Array.prototype.forEach, plus three small inline helpers
  startCase/kebabCase/hasPath/unescapeHtml).
- uPortal-webapp/src/main/webapp/WEB-INF/jsp/Statistics/reportGraph.jsp:
  swap four <rs:resourceURL var=... /> calls for canvg/rgbcolor/base64/
  canvas2image to <c:set var=... value="/resource-server/rs/..."/>
  (var indirection preserved).
- uPortal-webapp/src/main/webapp/media/skins/respondr/common/common_skin.xml:
  swap modernizr to /resource-server/rs/...; THEN remove modernizr
  entirely (zero Modernizr.* callsites in the workspace, no
  .no-js/.js CSS dependencies — pure dead weight). Remove the four
  polyfill <js> entries (core-js-bundle, regenerator-runtime,
  whatwg-fetch, webcomponents-polyfill) — uPortal targets BS5
  baseline browsers (no IE), all of which natively support these APIs.
- uPortal-webapp/src/main/webapp/media/skins/respondr/defaultSkin/skin.xml:
  swap fontawesome 4.7.0 to /resource-server/rs/...; remove
  normalize.css 2.1.2 (Bootstrap 5 reboot.css supersedes it for
  any BS5-baseline browser).
- uPortal-webapp/src/main/webapp/media/skins/respondr/common/scss/entity-selector.scss:
  path-swap nine famfamfam silk icon URLs from
  /ResourceServingWebapp/rs/famfamfam/silk/... to /resource-server/...
- uPortal-webapp/src/main/webapp/media/skins/common/javascript/uportal/modern-portlet-browser.js,
  WEB-INF/jsp/BackgroundPreference/viewBackgroundPreference.jsp,
  WEB-INF/flows/locale-selector/selectLocale.jsp: path-swap legacy
  tango / famfamfam silk + flag icon URLs to /resource-server/.
- uPortal-webapp/src/main/resources/org/apereo/portal/tenants/sampledata/portlet-definition/skin.portlet-definition.xml,
  uPortal-webapp/src/test/resources/org/apereo/portal/io/xml/portlet/test_4-0.portlet.xml:
  same path swap in tenant sample data + a test fixture.
- docs/developer/other/API.md: align an example URL with the modern
  context.

Notes: tango/0.8.90, famfamfam silk/1.3, fontawesome 4.7.0, and
modernizr/normalize bundles are byte-identical at the modern
/resource-server/rs/... paths in resource-server-webapp:1.5.x.
The remaining famfamfam refs in entity-selector.scss require Sass
recompilation at deploy time. <rs:resourceURL>'s var-indirection
swap to <c:set> uses JSTL imported via the standard
WEB-INF/jsp/include.jsp. The <rs:compressJs> tag stays valid (still
in resource-server-utils as a deprecated pass-through) — the cleanup
here is consumer-side. End-to-end verified by uPortal-start's full
Playwright suite (121/122 with 1 documented chrome dropdown flake;
all visual smoke + news-reader/CKEditor instantiation tests green).