Make Spring Security SecurityContext available to the application.

The filter chain now registered doesn't clear SecurityContext to make it available to CXF and to the following service invocation.

The problem we faced comes from DOSGi not linking registered filter chain with CXF request processing, as explained here:
https://issues.apache.org/jira/browse/DOSGI-183
Instead, filter chain is executed before CXF request processing, which normally cleares the context, thus preventing it being accessible when method invocation is triggered.

To solve this issue, a customised version of org.springframework.security.web.context.SecurityContextPersistenceFilter is used (SecurityContextPersistenceFilterSkipClearContext) which lets the user specify if context clearing should be skipped.
Using it with "skipClearContext" property set to true ensures that SecurityContext will be available in our environment, while DOSGI-183 is not fixed. 
Security issues may rise due to not removing the context (i.e. credentials disclosure to other callers of same thread).

Dependencies order has been changed to force Servlet API version 2.5 is resolved in compilation.

This patch also changes required roles in url filters.
The only role required to call all web services is now ROLE_USER.