Move SecurityConfig to its own special package.

No functional changes.