Annotations on Servlets not discovered on default bean-discovery-mode

The whole test suite showcases the new security annotations registered on Servlets. The problem is, Soteria searches for those annotations only on CDI beans, but Servlets are not beans by default. Tests pass since a `beans.xml` file is provided changing the bean discovery mode to "all".

I've found it myself by debugging why Soteria didn't register any identity stores, so this will also happen to other users.

I see two options here:
- Check for annotations on the ProcessAnnotatedType event in addition to the ProcessBean event. ProcessBan will still be needed since the class may have been wrapped with new annotations. The spec may have to be updated to reflect this change.
- Change the tests to define those annotations on a dedicated e.g. "ApplConfig" bean. That's what I imagine most people will do anyway on real deployments.

If you agree with option 2, I can start working on it. That won't change any behavior.