Add spec and tck tests for the use of `Subject` and `AccessControlContext` inside the `ThreadContext.SECURITY` bucket. @darranl can fill in the gaps where I've been vague