to stop it from being included in the enclosing @Configuration.

That way, if the app is not a web app, then there really is a
client_credentials OAuth2 resource (as claimed in the user guide).

Fixes gh-5735