Update and simplify security.yml, sync with authbucket/oauth2.