Simplify starter validation dependencies and make validation easier to exclude from web applications #16176
Description
The move to Jakarta EE API dependencies has made it a little bit harder to exclude validation. Rather than just excluding Hibernate Validator it's now also necessary to exclude the Jakarta EE validation API as well.
We currently have spring-boot-starter-validation that pulls in Hibernate Validator without the Java EE validation API, the Jakarta EE validation API, and Tomcat's EL implementation. The EL dependency is there as the starter is primarily intended for use outside of a web application and EL is normally provided by the web container. spring-boot-starter-web then pulls in Hibernate Validator without the Java EE validation API and the Jakarta EE validation API.
We should explore the possibility of spring-boot-starter-web depending on spring-boot-starter-validation with an exclusion for Tomcat's EL implementation. This would then allow users who do not want validation to depend on spring-boot-starter-web with a single exclusion of spring-boot-starter-validation. We'll need to be careful that we don't accidentally exclude Tomcat's EL implementation from Tomcat-based web apps.