Provide first class security support for actuator enpoints

[philwebb]

We need a way to secure actuator endpoints without necessarily needing Spring Security. The current situation of needing to make Spring Security directly aware of actuator URLs is quite problematic.

[philwebb]

The solution should be pluggable so that people can develop their own strategies.

[philwebb]

Changing EndpointHandlerMapping.extendInterceptors to add a HandlerInterceptor or WebRequestInterceptor may work. We could use the request.hasRole method to ensure that something has setup security.

[mbhave]

@philwebb the pluggable strategies solution will be for 2.0, right? Protecting actuators out of the box for 1.5 will be taken care of as part of in #6889.

[philwebb]

I think #6889 alone will be enough to support pluggable security. As long as the hasRole method is supported somehow then any security should work.