I am looking for a UI Framework that supports the following features:
I really doubt you can find anything like that, as you specify both browser-end, server-end and development-end requirements. It quite limits the field.
I think you won't find a single framework which supports those requiremens out of the box.
If the GUI is important to you, I'd recommend Wicket. The nested tabs and no-javascript-required are supported just fine (at least when I used it last year). This is totally not compatible with JSP though...
As a security system Spring Security (formerly Acegi) leaps to mind. It can be integrated with almost anything - if there isn't already a binding available.
The "Can interact with JMX MBeans" needs some clarification - what should it do with those beans?
If you're not working on a Mac you could also consider GWT (the GWT development environment doesn't really work with 64 bit java). It's fully java, the front-end gets compiled.
And integration with Commons Config / JFig? What do you wish to have configured? Even if the framework supports commons config it probably wouldn't allow you to configure what you want configured...
I personally am currently using spring MVC with spring security. I chose this because we already were using Spring, and I like JSP as the view technology as long as the views are simple.
If I had a requirement to create javascript and javascript-less pages with the same code, I'd have chosen Wicket so this flexibility would not be my problem.
I realize this is not an aswer to the question, so good luck!