code: public void updateSecurityMetadataWithRunAs(SecurityMetadata securityMetadataFromDD, IServletConfig servletConfig) {
          String runAs = servletConfig.getRunAsRole();
          if (runAs != null) {
              String servletName = servletConfig.getServletName();
              //only add if there is no run-as entry in web.xml
              Map<String, String> servletNameToRunAsRole = securityMetadataFromDD.getRunAsMap();
              if (servletNameToRunAsRole.get(servletName) == null) {
                  servletNameToRunAsRole.put(servletName, runAs);
                  List<String> allRoles = securityMetadataFromDD.getRoles();
                  if (!allRoles.contains(runAs)) {
                      allRoles.add(runAs);
                  }
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
                      Tr.debug(tc, "Added runAs role: " + runAs);
                  }
              }
          }
      }
docs: Updates the security metadata object (which at this time only has the deployment descriptor info)
  with the runAs roles defined in the servlet. The sources are the web.xml, static annotations,
  and dynamic annotations.
  
  @param securityMetadataFromDD the security metadata processed from the deployment descriptor
  @param servletConfig the configuration of the servlet