The class com.liferay.faces.bridge.config.BridgeConfigImpl
Parses WEB-INF/web.xml and WEB-INF/liferay-web.xml maintains a list of Servlet Mappings for Servlet javax.faces.webapp.FacesServlet.
This handling seems incomplete as all occurrences or META-INF/web-fragment.xml should also be included in this parsing, according to JSR 315.
I suppose one solution would be to use the Servlet 3.0 API to do this correctly. (To support older version webapps an alternative BridgeConfig could be loaded using the current approach.)