This commit makes a number of changes to the security handling within Undertow.

Firstly the whole authentication framework is now moved away from completion handlers as these are no longer used, instead the security context considers the current status of authentication as a state allowing for one transition to attemp authenitcation and a second transition for sending challenges - this fits better with the servlet APIs which may also cause a state transition.

Mechanisms now focus on processing a request or sending a challenge, there is no standard processing during responses for mechanisms after authentication is successfull.  Mechanisms that require this capability will now be required to register their own response wrapper.

The use of sessions to persist authenticated users has now evolved - the use of a cached user has now been moved to a mechanism and general notification support has been added to capture the events that need caching.  This simplifies the SecurityContextImpl as there are now no special cases.

The IdentityManager API has also evolved, there is subsequent work required for Digest based authentication but this is now closer to matching the needs of mechanisms running within Undertow.