Add Security Hint AOT Processing

[jzheaux]

This API allows for hint registration based on Spring Security's infrastructural beans

There are two built-in implementations:

1. AuthorizeReturnObjectCoreHintsRegistrar traverses the object graph of all Spring beans for methods that use @AuthorizeReturnObject. It creates the initial proxy class for each of those return values. Also, it uses each return value as a launch point to find other objects that use @AuthorizeReturnObject.

2. AuthorizeReturnObjectDataHintsRegistrar traverses Spring Data repository factory beans since each repository's primary domain object is often hidden behind generic erasure. It thereafter traverses any object it finds in the same way as 1.

Any return objects that were missed by the scan can be added by the application in the following way:

@Bean 
@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
static SecurityHintsRegistrar alsoProxy(AuthorizationProxyFactory proxyFactory) {
    List<Class<?>> classes = List.of(MyExtraClass.class, MyOtherExtraClass.class);
    return new AuthorizeReturnObjectHintsRegistrar(proxyFactory, classes);
}

or the application can add a custom SecurityHintsRegistrar.

There is also a sample application available here: https://github.com/jzheaux/spring-security-samples/tree/proxy-hints-using-pr/servlet/spring-boot/java/data

[marcusdacoregio]

That's so cool @jzheaux. I've left some minor feedback inline.