ISPN-4391 ISPN-4382 ISPN-4383 ISPN-4056 ISPN-4392 ISPN-4264 Lightweight Security, ClusterPrincipalMapper, CLI grant/deny

Sorry about the number of issues contained here, but they are all closely interconnected and dependent on one another.
A summary of the changes:
ISPN-4391 Fixes a bug in TransportConfigurationBuilder#read() and introduces a clustered test for authorization-enabled caches
ISPN-4382 Introduces a lightweight security checker which uses caller information (similar to what logging frameworks do). This improves performance and removes the requirement of a SecurityManager, but will fallback to it if present.
ISPN-4056 Finally enables caching of permission masks in the cluster registry to avoid repeated computation
ISPN-4383 Introduces a cluster registry-based PrincipalRoleMapper which allows for easy granting/denying of roles to principals
ISPN-4392 removes the mapper="classname" attribute from the global <authorization> element and replaces it with much nicer declarative elements such as <identity-role-mapper>, <cluster-role-mapper> while retaining the ability to use a custom mapper.
ISPN-4264 adds GRANT, DENY and ROLES statements to the CLI which allow manipulating role mappings when using the ClusterPrincipalMapper.

https://issues.jboss.org/browse/ISPN-4391
https://issues.jboss.org/browse/ISPN-4382
https://issues.jboss.org/browse/ISPN-4056
https://issues.jboss.org/browse/ISPN-4383
https://issues.jboss.org/browse/ISPN-4392
https://issues.jboss.org/browse/ISPN-4264
AFAICT, the import directive is only used by the compiler and the bytecode generated uses the FQDN of the classes, so it should throw the exception in static block

```
 static {};
    Code:
       0: iconst_1      
       1: invokestatic  #5    // Method sun/reflect/Reflection.getCallerClass:(I)Ljava/lang/Class;
       4: pop           
       5: goto          9
```