INT-3663: Fix Early BF Access for Security Module

JIRA: https://jira.spring.io/browse/INT-3663

Previously the `ChannelSecurityInterceptorBeanPostProcessor` was populated with direct `BeanDefinition`s for `ChannelSecurityInterceptor`s.
It caused an `early access to BeanFactory`.
The issue has been introduced by the `ChannelSecurityInterceptorFactoryBean`

* Rework `SecurityIntegrationConfigurationInitializer` do not populate `BeanDefinition`s to the `ChannelSecurityInterceptorBeanPostProcessor`, but just `bean names`
* Redesign `ChannelSecurityInterceptorBeanPostProcessor` to the `AbstractAutoProxyCreator`
* Introduce `SecuredChannel` annotation to be used on the `@Bean` level for `MessageChannel` definition
* Move `access policy` mapping to the `SecuredChannel` annotation

Address PR comments

Document `@SecuredChannel` annotation

src/reference/asciidoc/security.adoc

@@ -55,8 +55,14 @@ Where this is not the case references to the appropriate beans can be configured
 
 ----
 
-Starting with _version 4.0_, the same configuration is available when using `@Configuration` classes, by declaring a `ChannelSecurityInterceptorFactoryBean`.
-This class delegates all options for the `ChannelSecurityInterceptor` with a _builder_ pattern:
+Starting with _version 4.2_, the `@SecuredChannel` annotation is available, replacing the deprecated
+`ChannelSecurityInterceptorFactoryBean`, which was introduced in _version 4.0_ for Java & Annotation
+configuration in `@Configuration` classes.
+The `ChannelSecurityInterceptorFactoryBean` has been deprecated to
+avoid the possibility of undesired early load for dependent beans from the `BeanFactory` during the `ApplicationContext` initialization
+phase.
+
+With the `@SecuredChannel` annotation, the Java configuration variant of the XML configuration above is:
 
 [source,java]
 ----
@@ -64,22 +70,26 @@ This class delegates all options for the `ChannelSecurityInterceptor` with a _bu
 @EnableIntegration
 public class ContextConfiguration {
 
-	@Autowired
-	private AuthenticationManager authenticationManager;
-
-	@Autowired
-	private AccessDecisionManager accessDecisionManager;
-
 	@Bean
-	public ChannelSecurityInterceptorFactoryBean channelSecurityInterceptor() {
-		return new ChannelSecurityInterceptorFactoryBean()
-				.authenticationManager(this.authenticationManager)
-				.accessDecisionManager(this.accessDecisionManager)
-				.accessPolicy("admin.*", "ROLE_ADMIN")
-				.accessPolicy("user.*", null, "ROLE_USER");
-	}
+    @SecuredChannel(interceptor = "channelSecurityInterceptor", sendAccess = "ROLE_ADMIN")
+    public SubscribableChannel adminChannel() {
+    	return new DirectChannel();
+    }
+
+    @Bean
+    @SecuredChannel(interceptor = "channelSecurityInterceptor", receiveAccess = "ROLE_USER")
+    public SubscribableChannel userChannel() {
+    	return new DirectChannel();
+    }
+
+    @Bean
+    public ChannelSecurityInterceptor channelSecurityInterceptor(AuthenticationManager authenticationManager,
+    		AccessDecisionManager accessDecisionManager) {
+    	ChannelSecurityInterceptor channelSecurityInterceptor = new ChannelSecurityInterceptor();
+    	channelSecurityInterceptor.setAuthenticationManager(authenticationManager);
+    	channelSecurityInterceptor.setAccessDecisionManager(accessDecisionManager);
+    	return channelSecurityInterceptor;
+    }
+
 }
 ----
-
-NOTE: The `@EnableIntegration` annotation is required to provide the Spring Integration infrastructure (including Security) to the Application Context.
-In addition this `FactoryBean` falls back to `AuthenticationManager` and `AccessDecisionManager` beans with names `authenticationManager` and `accessDecisionManager` respectively, if they aren't provided in the `ChannelSecurityInterceptorFactoryBean` bean definition.

src/reference/asciidoc/whats-new.adoc

@@ -22,6 +22,13 @@ For complete details, see <<jmx-42-improvements>>.
 
 The `MongoDbMetadataStore` is now available. For more information, see <<mongodb-metadata-store>>.
 
+[[x4.2-secured-channel-annotation]]
+==== SecuredChannel Annotation
+
+The `@SecuredChannel` annotation has been introduced, replacing the deprecated `ChannelSecurityInterceptorFactoryBean`.
+For more information, see <<security>>.
+
+
 [[x4.2-general]]
 === General Changes