Rework security request matchers

Update the security request matchers so that a bean is no longer needed
when the matcher is used. Matchers can now be build by starting from
the `EndpointRequest` or `StaticResourceRequest` classes. For example:

http.authorizeRequests()
  .requestMatchers(EndpointRequest.to("status", "info")).permitAll()
  .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
  .requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()

Closes gh-7958

spring-boot-samples/spring-boot-sample-secure-oauth2-actuator/src/main/java/sample/secure/oauth2/actuator/ActuatorSecurityConfiguration.java

@@ -1,5 +1,6 @@
 package sample.secure.oauth2.actuator;
 
+import org.springframework.boot.actuate.autoconfigure.security.EndpointRequest;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.annotation.Order;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -16,12 +17,11 @@ public class ActuatorSecurityConfiguration extends WebSecurityConfigurerAdapter
 
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
-		// FIXME
 		// @formatter:off
-//		http.requestMatcher(ALL_ENDPOINTS).authorizeRequests()
-//				.antMatchers("/**").authenticated()
-//				.and()
-//			.httpBasic();
+		http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests()
+				.antMatchers("/**").authenticated()
+				.and()
+			.httpBasic();
 		// @formatter:on
 	}