Add marker interface for non-embedded servlet container

ErrorPageFilter is itself an EmbeddedServletContainerFactory
but it runs in a non-embedded container. Any component that assumes
the presence of an EmbeddedServletContainerFactory implies we are
running embedded is therefore invalid. WebSocketAutoConfiguration
had that problem.

Fixes gh-551
Prevent accidental failure of deployed war when management.port is set

We can't support (yet) embedded containers inside a deployed war (class
loader conflicts are inevitable, really). Until we figure out a way to
do it, we should just log a warning and advise the user to switch to
JMX for the actuator endpoints.

See gh-552
Use reflection to setup Websocket SCI so it works in Tomcat 8

Annoyingly this is necessary if we want to support Tomcat 7 and 8
since the package name changed.

Fixes gh-554
Add README to starters

Basic README content plus a short table of community-
contributed additional starters.

See gh-539
Correct property path for management.address

Fixes gh-558
Pass custom ResourceLoader down to read config files

If user sets a ResourceLoader on the SpringApplication, he might
reasonably expect that it would be used to read the config files.
This change ensures that it is (instead of just using the
DefaultResourceLoader).
Allow Batch configuration without DataSource

If the user provides a JobExplorer and a BatchConfigurer that
don't require a DataSource we can back off on configuring ours
(and anything else that needs a DataSource).

Fixes gh-561
Prevent retention of child from parent

When the child is listening for parent closed events
the parent has a reference to the listener which contains the chils.
Thust there is a cycle of references and a GC probalem waiting to
happen.

This change breaks the cycle by making the reference to the
child a WeakReference.

Fixes gh-559
Polish ParentContextCloserApplicationListener

Fix formatting for the recent ParentContextCloserApplicationListener
change, also some minor internal renames.
Link to community contributed starters README

Update reference docs to link to the community starters README.
Rename @ConfigurationProperties attributes

Rename `name` to `prefix` and `path` to `locations`.
Security Documentation Cleanup

- Add link to Spring Security's Global Method Security Java Configuration
- Fix link to SecurityProperties
- Add link to SECURITY Common application properties
- Remove unnecessary @Order from SecurityConfiguration
- Change method signature for @Autowired AuthenticationManagerBuilder to
  compile / match Spring docs
Escape URL characters in JAR URLs

Update the spring-boot-loader JarURLConnection class to decode entry
names in the same way as the stock JDK class. This allows encoded
entry names in the form `%c3%ab` to be loaded.

Fixes gh-556
Remove spring-data-commons

Remove direct reference to spring-data-commons, instead favoring
transitive dependency.

Fixes gh-557
Support Tomcat uri encoding (with UTF-8 default)

Introduce an extra `server.tomcat.uri-encoding` property used to
configure the URI encoding for the embedded tomcat container.

Defaults to `UTF-8` instead of the usual tomcat default of `ISO-8859-1`.

Fixes gh-540
Switch default security filter back on

If the user sets security.basic.enabled=false he has to remember
to @EnableWebSecurity.  Possibly we could be more helpful about the
exception, but I think this might be pilot error.

Fixes gh-568
Move @EnableRabbitMessaging into the non-protected package

Fixes gh-573
Log a warning if repository autscan is set to default package

Fixes gh-572
Make JAR files on classpath a special case for archive

If the user adds a JAR file to the classpath in "spring jar -cp ..."
he expected it to end up in the classpath of the executable jar
(i.e. in the nested lib/ directory). Before this change it would
have gone in the root of the executable JAR, causing errors at runtime.

The fix is slightly awkward, since it assumes that any JAR in the
"roots" of the ResourceMatcher come from the classpath (which *is*
the case currently, but might not always be at least in principle).
Seems like a reasonable compromise given it's a quick change
and some tests have been included.

Fixes gh-565
Add a @EnableWebSecurity if it looks like the user needs one

If the user explicitly disables the basic security features and forgets to
@EnableWebSecurity, and yet still wants a bean of type
WebSecurityConfigurerAdapter, he is trying to use a custom
security setup and the app would fail in a confusing way without
this change.

Fixes gh-568