All the files stored in WEB-INF are, on purpose, invisible to the outside. A URL pointing on WEB-INF/something will thus always result in a 404. WEB-INF is used to store resources needed by the application, but which must stay invisible to the outside.
Put the CSS files outside of WEB-INF.