Rework security autoconfiguration

This commit combines security autoconfigurations for
management endpoints and the rest of the application. By default,
if Spring Security is on the classpath, it turns on @EnableWebSecurity.
In the presence of another WebSecurityConfigurerAdapter this backs off
completely. A default AuthenticationManager is also provided with a user
and generated password. This can be turned off by specifying a bean of
type AuthenticationManager, AuthenticationProvider or UserDetailsService.

Closes gh-7958

spring-boot-samples/spring-boot-sample-actuator/src/main/resources/application.properties

@@ -11,6 +11,7 @@ server.tomcat.accesslog.pattern=%h %t "%r" %s %b
 security.require-ssl=false
 #spring.jackson.serialization.INDENT_OUTPUT=true
 spring.jmx.enabled=true
+endpoints.all.web.enabled=true
 
 spring.jackson.serialization.write_dates_as_timestamps=false