Add support for a `server.session.store-dir` property which can be used
to specify where session data source be saved.

Fixes gh-4191

Update TomcatEmbeddedServletContainerFactory so that session data isn't
serialized by default. Prior to this commit the SESSIONS.ser file would
either be written to `/tmp` or into `baseDir` (if one was set).

By not saving session data we align Tomcat with the other embedded
servlet containers and reduce the risk of sensitive information being
left in `/tmp`.

Fixes gh-4156

* gh-4168:
  Add `spring war` command

Add a `war` command to the CLI to generate WAR archives.

Fixes gh-925
Closes gh-4168

Closes gh-4184

Closes gh-4183

Closes gh-4182

Closes gh-4181

Closes gh-4180

Closes gh-4179

Closes gh-4178

Closes gh-4177

Closes gh-4176

Closes gh-4174
Closes gh-4175

Closes gh-4173

Closes gh-4172

The Java 6 module has been dropped in 2.4. Dependency management for
HikariCP-java6 is retained at the latest available version; 2.3.9.

Closes gh-4171

Closes gh-4169

Several libraries that Spring Boot supports depend on JBoss Logging but
they use a variety of versions. This means that the actual version of
JBoss Logging that will be used depends on your build system. Gradle
will pick the latest version that’s in the dependency graph, Maven
will pick the version that’s nearest the root of the graph and, if two
dependencies are equidistant, it’ll pick the version that’s pulled in
by the dependency listed first in the pom. In short, it’s very hard to
reason about the version of JBoss Logging that you’ll actually use at
runtime.

This commit adds dependency management for JBoss Logging so that a
consistent version is used, irrespective of your build system or
dependencies.

Closes gh-4185

* gh-3948-2:
  Allow TraceWebFilter to trace more attributes

Update TraceWebFilter to optionally trace more details from the
HttpServletRequest/HttpServletResponse. The `management.trace.include`
property can be used to change what aspects are logged.

Closes gh-3948

jersey-spring3 has a transtive dependencies on HK2’s bean-validator
module that embeds JBoss Logging, Hibernate Validator, and Classmate
without repackaging them. This makes it impossible to control the
version of those three libraries that will be used without relying on
classpath ordering.

This commit excludes the bean-validator dependency from jersey-spring3.
The Jersey starter already depends on our Validation starter which
pulls in the proper, and controllable, version of the three
dependencies listed above so users of our starters will be unaffected.

Closes gh-4186

Closes gh-3525

Closes gh-4124

See gh-4019

Closes gh-3853

Closes gh-3862

Closes gh-3813

Closes gh-3576

Closes gh-3767

Closes gh-2477

Closes gh-1768

Closes gh-3999

Previously, no `errors` attribute is made available in the standard JSON
error document if a request body object is invalid. This is due to the
fact that the framework throws a `MethodArgumentNotValidException holding
a `BindingResult` object that was not detected.

We now make sure to extract the `BindingResult` from such exception.

Closes gh-4166