Enable SecurityContext to handle composite principals

Injectable SecurityContext only naturally supports authentication schemes with a single principal.

However, OAuth and similar, delegation-oriented, authentication schemes have more than one principal. For example, OAuth has client and resource owner.

When writing filters for these schemes, one has to work around SecurityContext - in fact, the only way to make the second principal available to a resource class is by creating a specialized Principal and casting to that in the resource class - relying on the filter chain to have set an appropriate SecurityContext instance.

Discussion on how to do this is probably best done on the list.

Priority explanation: I put the priority to "major" because it currently negatively affects work I do on general filters in the delegated authorization space. I think this is a major area of JAX-RS to operate in - hence I am reluctant to set it to "minor".
#### Affected Versions
[2.0]