Answering my own question:
After much hacking, I finally got the SEAM booking demo (with seam security) working under glassfish.
I removed the el-* jars, and it appears to work OK - so it looks like these are not needed.
Why didn't you just run examples/glassfish, instead of hacking?
The examples/glassfish demo does not work with the new Seam security model.
In my quest to figure out what the heck was wrong, I tried to trim back the included jar files (OK, maybe a bad strategy - but I thought there might be some conflicts with the GlassFish jars).
Anyways - after some hacking, I do in fact have the Seam security stuff working, and of course the problems had nothing to do with el jars. However - the demo appears to work fine without them - so they do not appear to be needed.