JdbcTemplate and JmsTemplate pass settings with 0 values on to the driver

Issue: SPR-12338
ExposeInvocationInterceptor declares itself as PriorityOrdered now

Issue: SPR-12351
Consistent number handling in StandardTypeComparator (BigInteger support, doubleValue fallback)

Also includes a fix for the Comparable raw type invocation.

Issue: SPR-9913
Issue: SPR-12353
Reimplemented ServerEndpointExporter to avoid BeanPostProcessor role

Issue: SPR-12340
Polishing
AnnotationUtils favors local composed annotations over interface annotations and consistently logs introspection failures via lazily initialized logger

Issue: SPR-12355
Issue: SPR-12325
Issue: SPR-12329
HttpSessionHandshakeInterceptor and related web.socket.server polishing

Issue: SPR-12352
Consistent formatting of license headers, package javadocs, and import declarations
Consistent use of logIntrospectionFailure

Issue: SPR-12325
OrderUtils.getPriority uses AnnotationUtils.findAnnotation for consistent lookup rules and diagnostics

Issue: SPR-12357
Restored compatibility with JsonPath 0.9.x

Issue: SPR-12299
Add missing text to CachingResourceTransformer Javadoc
Fix JUnit imports in SourceHttpMessageConverterTests

When org.junit.Assert.* is statically imported, the class does not
compile in Eclipse/STS since XMLAssert extends junit.framework.Assert.
Better use of key iterator

This commit uses an EntrySet instead of looping over the keys and
retrieving the value in a separate call.

Issue: SPR-12356
Merge pull request #667 from luckybomb/spr12356

* spr12356:
  Better use of key iterator
Conditionally htmlEscape chars based on encoding

This commit adds new htmlEscape methods that take the character encoding
as a parameter. According to specs and recommendations, the list of
chars to be html escaped depends on the encoding used in the response.
If the current char encoding supports chars natively, we shouldn't
escape those; of course, reserved chars (<,>,',",&) should always be
escaped.

See: http://www.w3.org/TR/html4/sgml/entities.html#h-24.3
See: spring-projects/spring-framework#385 by @candrews

Issue: SPR-9293
Add an option to set an Origin whitelist for Websocket and SockJS

This commit introduces a new AllowedOriginInterceptor WebSocket
HandshakeInterceptor. It will filter Origin header value against a list of
allowed origins.

AbstractSockJsService as been modified to:
 - Reject CORS requests with forbidden origins
 - Disable transport types that does not support CORS when an origin check is
   required
 - Use the Origin request header value instead of "*" for
   Access-Control-Allow-Origin response header value
   (mandatory when  Access-Control-Allow-Credentials=true)
 - Return CORS header only if the request contains an Origin header

It is possible to configure easily this behavior thanks to
StompWebSocketEndpointRegistration#setAllowsOrigins(String...).

Please notice that this commit does not change the default behavior:
cross origin requests are enabled by default.

Issues: SPR-12226