• <param-value> starting with "/" should be treated as possible static web resource (config files etc.), support for delimited (e.g. ",") values
• highlight invalid <url-pattern> values
• <error-page>: <location> should be treated as forward resource (static, servlet)
• <form-login-config>: as above
• <role-name> in <auth-constraint> and <security-role> should be linked/highlighted if not defined etc.
• support <error-code> HTTP status values
• ...

I'm sure other people will come up with more ideas.