Replace path-prefix sniffing with proper content negotiation #3965

In a couple of places in the security subsystems of OE, we're using the URL path to determine what kind of response to send. This is a violation of REST principles where the content returned to the client should be negotiated with the client based on the Accept header. The idea is to replace this block and this similar block and with something that looks at the request's Accept header. Something like:

MediaTypeRequestMatcher htmlMatcher = new MediaTypeRequestMatcher(
        new HeaderContentNegotiationStrategy(), MediaType.TEXT_HTML);
htmlMatcher.setIgnoredMediaTypes(Set.of(MediaType.ALL));   // treat */* as "not HTML"

if (htmlMatcher.matches(request)) {
    response.sendRedirect(request.getContextPath() + "/Home?access=denied");
} else {
    // JSON 403
}

This should make it so requests from the browser (or a client acting as a browser) return a redirect, which can be processed correctly, but requests from the Fetch API return a JSON response.

Bonus addenda:

• It would be worthwhile hunting down spots where this can be expected to return the JSON error and ensuring that the JS processing those reacts correctly to the JSON responses
• It would be better if the fetch / AJAX requests directly set the Accept: header to application/json, so that the client was explicitly requesting the format it wants. We could then evolve this to support multiple different content types.