Some more tests for RBAC

Here's another bunch of tests for RBAC. Namely:

- tests for `read-whole-config` operations, that is `read-config-as-xml` and the non-published `describe`
- added few missing tests for removing security domains
- most notably, a soak test for RBAC (this is not enabled by default, only in a specific Maven profile called `rbac-soak`)