Add Spring MVC-generated path suffixes to endpoint paths

Spring Security doesn't know that Spring MVC maps /foo, /foo.json
and /foo/ all to the same handler. This change explicitly adds
suffixes to the actuator endpoint matchers so they are properly
protected.
Add spring.messages.cacheSeconds to global config

Fixes gh-625
Explcitly state in docs that Spring Security is required

... if you use management.security.* properties

Fixes gh-595
Added ActiveMqCredentials (optional)

Fixes gh-618
Refactor discussion of management.security.*

Really fixes gh-595
Upgrade to Logback 1.1.2
Add activemq properties to appendix

Fixes gh-618
Add separate section in "features" docs on Security

Lists all the basic autoconfig defaults and quick pointers on
how to change or disable.

Fixes gh-514
Fix docos references to @ConfigurationProperties(prefix="...")

Fixes gh-629
Ensure Groovy bean builder does not enforec XML validation

Since it is not parsing XML it makes no sense to be validating
and it would cause exceptions when importing "namespace"
features. This brings the Boot usage of the bean builder inline
with that in Spring Core.

Fixes gh-630
Add test for groovy-xml parsing
Missing groovy source for test
Extend use of reflection for port in Jetty 9

There was already a reflection hack in place for logging the local
port in Jetty 8/9. It wasn't being used for the getPort() method
for some reason, so that needed to be fixed.

Fixes gh-635
Polish
Revert "Remove test dependencies from spring-boot-starter-parent"

This reverts commit 5ded496dc32770148935574ff1c649799f251413.

Fixes gh-628
Next development version
Fixup starter-parent for 1.0.2 SNAPSHOT
Fix path stripper in JolokiaEndpoint to account for management.contextPath

When the user sets management.contextPath=/admin the Jolokia
endpoint gets mapped to /admin/jolokia, but that the path stripper it uses
internally makes a false assumption about the form of the request path.
The fix is simple (just use a smarter search for the endpoint path in the
request path).

Fixes gh-642
Add test for gh-645
Fix springloaded co-ordinates

Apparently springloaded 1.1.5 was released to Maven Central with a
different groupId than to repo.spring.io. It would have worked in
milestones because the repository was declared.

See gh-648