Pin order to of crsh auto configuration to happen after any security related configuration

If crsh auto configuration happens too early a AuthenticationManager contributed by SecurityAutoConfiguration will not be detected
Properly close application context in tests
Allow management endpoints to express what http methods they support

Previously a management endpoint was either GET or POST. That requirement seems limited.
Add missing tests
Add auto configure support for Jolokia a JMX-HTTP bridge
Add Jolokia to spring-boot-dependencies