Added support for Servlet 3.1's changeSessionId()

Added support for Servlet 3.1's HttpServletRequest#changeSessionId()
method as another approach to session fixation protection. This has a
big advantage in that it avoids all issue with the
SessionBindingEventListener. As such, Spring Security now detects
if it is running in a Servlet 3.1 or newer container and uses this
new method as the default. "Migration" is still the default in older
containers.

As agreed upon in the comments to SEC-2135, the changes involved
deprecating the old SessionFixationProtectionStrategy and
ConcurrentSessionControlStrategy and replacing them. This way,
anyone manually using the legacy system will continue to observe the
same behavior with only compile warnings about deprecation. An enum
was created (SessionFixationProtectionScheme) to specify the session
fixation protection scheme that should be used. This allows for
direct mapping between the namespace attribute value and the enum
constant, and also provides support for future programmatic
@Configuration.

By consequence, this also fixes SEC-2137.

Issues: SEC-2135, SEC-2137