[WFLY-490] Add the realm name to the group so that realm specific matches can be subsequently made.
[WFLY-490] Move all access control related resource definitions to core-service=management/access=authorization
[WFLY-456] / [WFLY-490] Add the base resource definition for audit logging, currently just a place holder to illustrate where this will go.
[WFLY-490] added tests for runtime reconfiguration of sensitivity/application-type
[WFLY-1618] / [WFLY-490] Add validation based on an enumeration to the PrincipalResourceDefintion.

Also make the attributes on PrincipalResourceDefinition read only - i.e. principals can be added to or remove from the include / exclude list but existing definitions can not be modified.
[WFLY-490] Fix ParseAndMarshalModelsTestCase following core-services=management restructuring.
[WFLY-1618] / [WFLY-490] Mark principal removal as being complete.
[WFLY-1618] / [WFLY-490] Addition of the runtime role mapping implementation.

Also Switch identity association over to use an AccessControlContext instead of ThreadLocal.
Expose Caller from OperationContext and initialise based on the currently associated Subject.
As the role mapping is happening within controller additional Principal types are created that controller can expect to present in the Subject of the authenticated user.
Added a new is-caller-in-role operation, this allows a quick check that the currently authenticated user has the expected role.
The Subject is now marked as readOnly so we do need to deal with the contents changing.
Added a test case to test various permutations of role mapping and also minor fixes for issues detected by the test.
[WFLY-490] A custom PermissionCollection where no permissions are identified, to avoid NPEs where no Permissions found.
[WFLY-490] An update to the FileSystemDeploymentService to check the result of the composite operation before attempting to access individual results.

Additional changes will be required in this are for access control to allow deployments from an in-vm process - however code calling a composite operation should at least be able to cope with it not succeeding.
[WFLY-490] create a fake Caller in some tests
[WFLY-490] [WFLY-1790] fixed the HostScopedRole* operations
[WFLY-490] Update the current management model to JMX integration to hide the entire management model representation if access is prevented.

(Previously errors were being reported to the client and remaining functionality of JMX clients such as jconsole was subsequently broken)
[WFLY-490] / [WFLY-1800] Upgrade to Remoting JMX 2.0.0.Beta2
[WFLY-490] / [WFLY-1804] Ensure the Subject of the current remote user is associated with the AccessControlContext for JMX requests.
[WFLT-490] / [WFLY-1618] Update the runtime role updates to avoid synchronization during boot.
[WFLY-490] / [WFLY-1618] Add TRACE logging to role mapping logic.

Generally this should not be required but in an extreme case of trying to identify why a user was or was not granted a role this can be used to identify the matches used in the decision process.
[WFLY-490] For IN-VM calls or more specifically calls that do not have a remote user associated with the AccessControlContext use a SecurityManager permission check to verify the calling code can run as the default role.
[WFLY-490] Set up some integration tests
[WFLY-490] Add OperationContext javadoc; rename AuthorizationResponse