Make javax.security and javax.validation optional

Currently the OSGi manifest creation via Gradle automatically imports all packages that are used by hibernate-core. Although this saves you from having to list all the imports manually, it does mean that some optional dependencies suddenly become mandatory dependencies. I've updated the hibernate-core Gradle build file to make the hibernate-core dependencies on javax.security and javax.validation optional. This way you are not forced to have these dependencies available in your OSGi container. More information in HHH-7941.