fix(bpmn/message-event): make serviceTask behavior for throw/end optional

The serviceTask behavior is now optional for messageEndEvents and
throwingMessageEvents (intermediate).

That restores backwards compatibility with the non-behavior message
events.

Closes CAM-1156
fix(webapps/security-filter): fix attachHeaders on Websphere

Websphere throws an IllegalArgumentException when
HttpServletResponse#setHeader is called with a null argument
value.

This commit adds the appropriate != nul checks to ensure compatibility.

Related to CAM-1055.
Merge branch 'master' of github.com:camunda/camunda-bpm-platform