Add @AuthorizeRequestMapping annotation

Combined with gh-16249 we could add an annotation (e.g. @AuthorizeRequestMapping) that allows adding authorization rules to Spring Controllers but happens at the same time as authorizeHttpRequests() (to reduce the attack surface) rather than late like method security.

The need for a new annotation is due to the fact that @PreAuthorize allows access to method parameters, but we will not have access to those parameters in a web based authorization model.

We'd need the ability to scan for all annotated controllers and create a mapping of the RequestMapping to authorization rules.

A few examples:

@GetMapping("/users/{id}")
@AuthorizeRequestMapping("hasRole('ADMIN')")
User findById(String id) {

}

@GetMapping("/users/{id}")
@AuthorizeRequestMapping("@authz.canReadUser(authentication, #id)")
User findById(String id) {
  // authz is a bean name
  // canReadUser is a method on the authz bean that returns a boolean and accepts a String that is the id of the user to check
  // authentication is the current Authentication (same as all SpEL based Security)
  // id is the parsed id from the @GetMapping
}

The following adds an authorization rule that only admin can access the routes of /admin/users/{id} and /admin/users/.

@AuthorizeRequestMapping("hasRole('ADMIN')")
class AdminController {

  @GetMapping("/admin/users/{id}")
  User findUserById(String id) {

  }

  @GetMapping("/admin/users/")
  List<User> users() {

  }

}

We also need the ability to take into account all of the information that a Spring Controller would take into account (e.g. HTTP Method, Content negotiation, etc).

cc @rstoyanchev