Support 'security' and 'stateless' flags in security config

`'security' => false` will disable the firewall even if there are listeners configured.

`'stateless' => true` will prevent `ContextListener` from getting registered.