You are right, it is not in any of the provided jars when selecting an "ejb3" installation. I did not check other installation types. Maybe you should file a bug report?
Is there a resolution for this yet?
I am using JBoss IDE1.5 and @DeclareRoles is still not available in any of the jars mentioned in this thread!
Just checked JBoss AS 4.0.4-GA w/ EJB3 RC9 - @DeclareRoles is in $JBOSS_HOME/client/jboss-ejb3-client.jar under javax.annotation.security ...
Also in jboss-ejb3x.jar. from deploy/ejb3.deployer.