UAA OAuth2 defaults are an OAuth anti-pattern

A new installation of Stratos deployed on CloudFoundry defaults to using a client ID of cf.

Not only does this not work (until the cf client is modified in UAA to allow a redirect to the Stratos installation), it is not the way OAuth is intended to work

The cf client which ships by default is intended for the cf CLI binary and amongst other things has no client secret set (which is normal for an OAuth client that is widely distributed).

We should instead document and encourage users to create a new client ID for their Stratos console.

Since the Stratos console is a client of type web application (which ends up storing a database of refresh tokens), it should be configured with an appropriate client secret. A reason why this is useful, is that in the event of a leak of the database of refresh tokens, is that they can be made invalid by simply rotating the client secret within UAA.

I suggest at minimum the following changes, that I'd be happy to implement if the approach agreed:

1. Change initialiseConsoleConfig() and/or GetClientId() signature and implementation to return an error if CONSOLE_CLIENT / CF_CLIENT is not set (instead of defaulting to cf).

2. Change initialiseConsoleConfig() to error if CONSOLE_CLIENT_SECRET is not set, and remove incorrect advice that // Special case, mostly this is blank, so assume its blank.

3. SKIP_SSL_VALIDATION=true appears to be set by default in deploy/cloud-foundry/config.properties. It's not safe to ship software that is insecure by default. I think it's fine to allow skipping of SSL validation for various test / debug reasons, but that needs to be opt-in, not the default.

4. Add documentation for how to create an appropriate UAA OAuth client with redirects / client secret etc set appropriately.

Let me know if you'd be open to a PR for the above.

Start by tracing initialiseConsoleConfig() and GetClientId() to understand how CONSOLE_CLIENT, CF_CLIENT, and CONSOLE_CLIENT_SECRET are currently handled. Review deploy/cloud-foundry/config.properties for the default SKIP_SSL_VALIDATION setting. Done means missing credentials fail safely, insecure SSL skipping is opt-in, and documentation explains the required UAA client redirects and secret.