I hope more members of the community chime in on the above topics; in the meantime, IMO:
(1) ModeShape is a JCR Java implementation. There is no standardized Java API for interacting with antiviruses that I'm aware of (this is very much OS and AV product specific). So this is something which you'll have to implement/handle separately
(2) is definitively possible with JCR & ModeShape. The downside is that JCR versioning is complicated and requires a lot of internal logic meaning that performance will not be ideal. It's up to you to determine (ideally by prototyping) if what ModeShape offers is good enough or not.
(3) Depends on what you mean by management: JCR is very powerful when it comes to things like query, metadata, schema etc. So if your uses case requires more than just "files on disk", it might work very well. If on the other hand you just want to do CRUD operations, then it might not warrant the complexity.
The optional points (1) and (2) are not part of the JCR feature set, so most likely you'd have to come up with your own solution for them.