SEC-2229: spring-security-web dependency polish

- remove direct dependency on spring-aop
- spring-tx and spring-jdbc optional
SEC-2129: AntPathRequestMatcher also supports case sensitive comparisions
SEC-2282: Add CSRF documentation to the reference manual