Inclusion of SPI provider implementation for Security

### Decoupling AG Security from AG Controller

As requested on https://issues.jboss.org/browse/AEROGEAR-617. AG Controller and AG security must be decoupled for users that don't want the whole stack.


The complete workflow was already tested:

* Login (successful/failure as admin and simple user)
* Logout
* Registration
* OTP

#### What's next?

* We have to test the whole workflow for REST clients
* Integration with TODO app (I already did it and it will be attached in a separated PR)