I guess it has something to do with the from components.java directive, as seen in the guide. I had a similar setup and it made the difference to add the line into the publication block:
publications {
mavenJar(MavenPublication) {
artifactId 'rest-security'
artifact jar
from components.java
}
}