[BZ:999846] Add jbossweb and jbossxacml to -with-security bom

Bugzilla reference: https://bugzilla.redhat.com/show_bug.cgi?id=999846

Both jbossweb and jbossxacml need to be added to -with-security bom, in case the customer's pom depends on each declared dependencies in the -with-security bom.