SEC-2229: Add optional dependencies to spring-security-config

spring-tx and spring-jdbc aren't pulled in transitively from
spring-security-web now, so we must include them as optional dependencies.