Rename @ConfigurationProperties attributes

Rename `name` to `prefix` and `path` to `locations`.
Security Documentation Cleanup

- Add link to Spring Security's Global Method Security Java Configuration
- Fix link to SecurityProperties
- Add link to SECURITY Common application properties
- Remove unnecessary @Order from SecurityConfiguration
- Change method signature for @Autowired AuthenticationManagerBuilder to
  compile / match Spring docs
Escape URL characters in JAR URLs

Update the spring-boot-loader JarURLConnection class to decode entry
names in the same way as the stock JDK class. This allows encoded
entry names in the form `%c3%ab` to be loaded.

Fixes gh-556
Merge pull request #569 from martinlau/Issue-556

* Issue-556:
  Escape URL characters in JAR URLs
Remove spring-data-commons

Remove direct reference to spring-data-commons, instead favoring
transitive dependency.

Fixes gh-557
Support Tomcat uri encoding (with UTF-8 default)

Introduce an extra `server.tomcat.uri-encoding` property used to
configure the URI encoding for the embedded tomcat container.

Defaults to `UTF-8` instead of the usual tomcat default of `ISO-8859-1`.

Fixes gh-540
Merge pull request #542 from snicoll/gh-540

* gh-540:
  Support Tomcat uri encoding (with UTF-8 default)
Switch default security filter back on

If the user sets security.basic.enabled=false he has to remember
to @EnableWebSecurity.  Possibly we could be more helpful about the
exception, but I think this might be pilot error.

Fixes gh-568
Move @EnableRabbitMessaging into the non-protected package

Fixes gh-573
Log a warning if repository autscan is set to default package

Fixes gh-572
Make JAR files on classpath a special case for archive

If the user adds a JAR file to the classpath in "spring jar -cp ..."
he expected it to end up in the classpath of the executable jar
(i.e. in the nested lib/ directory). Before this change it would
have gone in the root of the executable JAR, causing errors at runtime.

The fix is slightly awkward, since it assumes that any JAR in the
"roots" of the ResourceMatcher come from the classpath (which *is*
the case currently, but might not always be at least in principle).
Seems like a reasonable compromise given it's a quick change
and some tests have been included.

Fixes gh-565
Add a @EnableWebSecurity if it looks like the user needs one

If the user explicitly disables the basic security features and forgets to
@EnableWebSecurity, and yet still wants a bean of type
WebSecurityConfigurerAdapter, he is trying to use a custom
security setup and the app would fail in a confusing way without
this change.

Fixes gh-568
Switch on @EnableTransactionManagement by default

Fixes gh-576
Fix quotes in a Gradle example
Re-order security auto configuration so the fallback can be applied

The management security autoconfiguration wanted to come last in the chain
but that won't suit the fallback that was already in place for gh-568. This
change re-orders the autoconfig so that @EnableWebSecurity is still added
if the user sets security.basic.enabled=false and includes the actuator
endpoints.

Fixes gh-568
Bad Tomcat 8 section reference to websockets pom

Removed this link "The websocket sample shows you how to do that in Maven." since the example no longer has properties that show how this is done. Dave Syer edited the section in a previous issue by adding the example to the POM ( https://github.com/spring-projects/spring-boot/issues/430 ) but it appears that the bad link was not removed.
Ensure new VCAP_SERVICES format works
Enable support for use of encryption in Maven's settings.xml

This commit updates the CLI so that it will decrypt any encrypted
passwords in a user's Maven settings.xml file.

The code that performs the decrytion has a transitive dependency on
three types in Plexus' logging API. There are tens of different
artifacts containing this API available in Maven Central. Rather than
bloating the API with a dependency on a complete Plexus container,
which could perhaps be considered the primary source, a dependency on
a considerably smaller artifact has been introduced.

Closes #574
Log AutoConfigurationPackages warnings just once

Update AutoConfigurationPackages to log warnings on the first access,
rather than during setup. This works around the fact that the CLI
currently add multiple @EnableAutoConfiguration annotations.

Fixes gh-579
Polish