Upgrade Spring and Spring Security
Make DefaultTokenServices a @Bean

It's a bit awkward to do this because it makes it harder to back
off if the user provides his own @Bean, but it's worth it for the
JDBC case because the AuthorizationServerTokenServices needs to
be @Transactional in that case. If the user only provides a
JDBC TokenStore the system now should be more resilient to
duplicate tokens under load.

Fixes gh-276