Fix SpEL varargs handling and usage of other getValue() methods

Building on the initial work for SPR-12326, this commit
addresses three problems:

Firstly the ReflectiveMethodResolver is modified to consider
a direct parameter match more important than a varargs match.
Also in that same type when there are a number of close
matches, the first one is taken rather than the last one.

Secondly more testcases and better support have been added
for the case of passing a single parameter to a varargs
accepting method.

Finally it is possible to set the root context object
indirectly and not pass it on getValue() calls to the
expression objects but not all variants of getValue()
were handling that. This is now fixed.

Issue: SPR-12326
EclipseLinkJpaDialect's getJdbcConnection uses a lazy ConnectionHandle (allowing for deferred internal transaction begin)

Issue: SPR-7753
Polishing
Consistent throwing of BeanInstantiationException for factory methods, including a hint about circular references

Issue: SPR-12317
Latest dependency updates (EhCache 2.9, Joda-Time 2.5, Jackson 2.4.3, Tiles 3.0.5, Tomcat 8.0.14, FreeMarker 2.3.21)
Test for ImportBeanDefinitionRegistrar double scan

Issue: SPR-12334
Polishing
Revised test for ImportBeanDefinitionRegistrar double scan

Issue: SPR-12334
(cherry picked from commit 6e5711a)
Allow defining default content negotiation strategy

During the HTTP Content Negotiation phase, the ContentNegotiationManager
uses configured ContentNegotiationStrategy(ies) to define the list of
content types accepted by the client.

When HTTP clients don't send Accept headers, nor use a configured
file extension in the request, nor a request param, developers can
define a default content type using the
ContentNegotiationConfigurer.defaultContentType() method.

This change adds a new overloaded defaultContentType method that takes a
ContentNegotiationStrategy as an argument. This strategy will take the
current request as an argument and return a default content type.

Issue: SPR-12286
QualifierAnnotationAutowireCandidateResolver calls BeanFactory.getType defensively

Issue: SPR-12191
Polishing
Polish SPR-12286

Issue: SPR-12286
Polish Javadoc
Update documentation for Map arguments

Issue: SPR-12347
Update javadoc
Add an option to set an Origin whitelist for Websocket and SockJS

This commit introduces a new OriginHandshakeInterceptor. It filters
Origin header value against a list of allowed origins.

AbstractSockJsService as been modified to:
 - Reject CORS requests with forbidden origins
 - Disable transport types that does not support CORS when an origin
   check is required
 - Use the Origin request header value instead of "*" for
   Access-Control-Allow-Origin response header value
   (mandatory when  Access-Control-Allow-Credentials=true)
 - Return CORS header only if the request contains an Origin header

It is possible to configure easily this behavior thanks to
WebSocketHandlerRegistration#setAllowedOrigins(String...) and
StompWebSocketEndpointRegistration#setAllowedOrigins(String...).

Please notice that this commit does not change the default behavior:
cross origin requests are enabled by default.

Issues: SPR-12226
Add an option to set an Origin whitelist for Websocket and SockJS

This commit introduces a new AllowedOriginInterceptor WebSocket
HandshakeInterceptor. It filters Origin header value against a list of
allowed origins.

AbstractSockJsService as been modified to:
 - Reject CORS requests with forbidden origins
 - Disable transport types that does not support CORS when an origin check is
   required
 - Use the Origin request header value instead of "*" for
   Access-Control-Allow-Origin response header value
   (mandatory when  Access-Control-Allow-Credentials=true)
 - Return CORS header only if the request contains an Origin header

It is possible to configure easily this behavior thanks to
StompWebSocketEndpointRegistration#setAllowedOrigins(String...).

Please notice that this commit does not change the default behavior:
cross origin requests are enabled by default.

Issues: SPR-12226
Add an option to disable automatic addition of CORS header

Issues: SPR-12283