tools: junit_tests: compile generated sources via optional suite_srcs

junit_tests derives its @Suite.SuiteClasses list by scanning the source
file paths in srcs. That cannot work when the sources to compile are a
generated .srcjar -- a single opaque artifact with no scannable paths --
as in the servlet-flavour EE8/EE10 test modules.

Add an optional suite_srcs parameter: when set, the suite class names
are scanned from suite_srcs (the canonical .java test files, whose
class names the transform preserves) while srcs (the .srcjar) is what
gets compiled. Existing callers are unaffected; suite_srcs defaults to
srcs.

Also mark the generated suite testonly (it always is), which lets
suite_srcs reference the testonly canonical test filegroups.

Change-Id: I9e81bdabae39701abaf4473619b1cf9a36a81eb7

tools/BUILD

diff --git a/tools/BUILD b/tools/BUILD
index 617d077..2ae47d1 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -1,6 +1,7 @@
 exports_files([
     "diff_allowlist.sh",
     "diff_overlap.sh",
+    "generated_srcs_test.sh",
     "java_runtime_jars_manifest.bzl",
     "runtime_jars_allowlist.bzl",
     "runtime_jars_overlap.bzl",

tools/junit.bzl

diff --git a/tools/junit.bzl b/tools/junit.bzl
index d7d3b62..2074bd0 100644
--- a/tools/junit.bzl
+++ b/tools/junit.bzl
@@ -67,12 +67,35 @@
     implementation = _impl,
 )
 
-def junit_tests(name, srcs, **kwargs):
+def junit_tests(name, srcs, suite_srcs = None, **kwargs):
+    """Generate a JUnit4 @RunWith(Suite) test class and run it as a java_test.
+
+    Args:
+      name: name of the java_test target.
+      srcs: sources compiled into the test. May be plain `.java` files or a
+          generated `.srcjar` (for example a transformed servlet-flavour test
+          srcjar).
+      suite_srcs: optional. The sources whose file *paths* are scanned to derive
+          the `@Suite.SuiteClasses` list. Defaults to `srcs`.
+
+          Pass this only when `srcs` is a `.srcjar`: a srcjar is a single opaque
+          artifact whose entries cannot be enumerated at analysis time, so the
+          suite cannot be generated from it. Point `suite_srcs` at the canonical
+          `.java` test files instead. This is valid because the servlet-flavour
+          transform preserves package and class names, so the canonical files
+          yield exactly the class names present in the transformed srcjar.
+          The canonical EE8/EE10 generated-test targets use this.
+      **kwargs: forwarded to java_test (deps, runtime_deps, size, ...).
+    """
     s_name = name.replace("-", "_") + "TestSuite"
     _gen_suite(
         name = s_name,
-        srcs = srcs,
+        srcs = suite_srcs if suite_srcs else srcs,
         outname = s_name,
+        # The generated suite is always test-scoped; marking it testonly also
+        # lets suite_srcs reference testonly filegroups (the canonical test
+        # sources of a generated-flavour module).
+        testonly = True,
     )
     jvm_flags = kwargs.get("jvm_flags", [])
     jvm_flags = jvm_flags