Better support for custom AccessDecision voters

@Secured("FOO_BAR")

Let's imagine you have made Voter that wants to make checks for all tokens that starts with "FOO_"
Spring security core now makes WebExpressionConfigAttribute's to your custom voters.
And if your voter now denies the access it's also processed by the WebExpressionVoter that ends up with an exception, because it cannot turn String "FOO_BAR" to boolean value.

Some kind of better mechanism would be nice for custom voters so we do not end up in a situation that the WebExpressionVoter processes the custom access strings.

Start by reproducing the @Secured("FOO_BAR") case with a custom voter, WebExpressionConfigAttribute, and WebExpressionVoter. Trace why the custom access string reaches WebExpressionVoter; done means custom FOO_ tokens can be handled by the custom voter without WebExpressionVoter raising a boolean-conversion exception.

Written by the indexing model from the issue text.