I'd love to be helpful. I'll even code patches. But I am far from the guru around here, though I may be able to recruit some assistance.

• https://github.com/apache/servicemix-specs/tree/master/jsr303-api-1.1.0? This is a device that addresses the provider-neutral problems with the javax.validation API. I can't get it to work in 'default' mode, but it can be used with HV with an explicit provider. Are you comfortable with planning on it?
• https://github.com/apache/servicemix-bundles/tree/master/hibernate-validator-5.0.2.Final is an incomplete solution, in that it does not solve the EL problem. However, it does avoid the non-OSGi dependencies. Would you like a patch that does what it does with OSGi metadata?
• That leaves the problem of EL. One approach is to add dynamic package imports for any well-known EL providers. I'm puzzled that there does not seem to be a servicemix 'spec' jar for this, but I might have missed it.