RunAsManager replacement

RunAsManager can add to or change the existing authentication for the duration of a message, a request, or a method call.

It overloads the authority string to include instructions to Spring Security as to what authorities to temporarily grant. It is primarily designed to work with the @Secured annotation and with the access XML attribute when not using expressions.

As a first step to supporting this with the authorization manager API, we should:

• Improve AuthorizationFilterParser to support use-expressions="false"
• Improve AuthorizationFilterParser to adapt the Supplier<Authentication> for RUN_AS attributes
• Improve @Secured method handling to adapt the Supplier<Authentication> for RUN_AS attributes

UPDATE: Let's wait on these subtasks. This isn't the way that we want to do impersonation and privilege escalation going forward, and so I don't really want to support a legacy way in a new API. I'll leave this ticket open for investigating what this support should look like going forward.

It's worth considering whether a new contract is needed like Supplier<Authentication> adapt(Supplier<Authentication> authentication, T context) that can be supplied to alter how the adaptation is performed.