Add IdentityStores that delegate to whatever store the container has configured

While EE Security allows identity stores to be overridden by container configuration, a subtle variety is where the application itself declares it wants to use the container facility.

Jaspic already support this, although only for the callername/password credential. See [PasswordValidationCallback](https://javaee.github.io/javaee-spec/javadocs/javax/security/auth/message/callback/PasswordValidationCallback.html)