Be defensive about Spring Security dependencies

In particular don't assume that Spring Security Web is on the
classpath, just because Spring Security Core is.

Fixes gh-363
Add support for Spring Loaded in Maven and Gradle

Requires Loaded 1.1.5 (or better).

For Maven you can just add springloaded to the dependencies of the
spring-boot plugin (and also set MAVEN_OPTS=-noverify).

For Gradle add springloaded to the build dependencies (-noverify
can be added by the plugin).

In both cases there is also support for adding an arbitrary java agent
via configuration. Samples are provided in
spring-boot-sample-[simple,web-ui].

The ApplicationPlugin is only added if there is no JavaExec task
already present, and additionally it computes its own man class if
none is provided. So "gradle run" and "gradle bootRun" look
superficially similar, but "bootRun" has extra options, including
the agent and Loaded support.

Fixes gh-251, gh-183
Add snakeyaml to spring-boot-starter

Fixes gh-366
Update YAML refs in docs
Investigated JSP support

Summary: Tomcat works with WARs. Jetty doesn't work.

See gh-367
Revert change that breaks tests in werid way
Add JettyServerCustomizer for Jetty container customization

E.g. can be used to add SSL support to a Jetty container, similarly
to a TomcatConnectorCustomizer.

Fixes gh-345
Polish
Restore loading order of 'application.properties'

Restore the order that `ConfigFileApplicationListener` attempts to load
application.properties so that local files always have a higher
precedence than bundled classpath files.

This fixes a regression introduced with 1.0.0.RC2.

Fixes gh-370
Ensure DispatcherServlet is available in a deployed WAR

The DispatcherServletAutoConfiguration had a condition on it that
meant it wasn't used at all if there was no EmbeddedServletContainerFactory.
It's amazing that any WAR ever deployed.

Also added some info logging to servlet and filter registrations.
Try to make Jetty scan TLDs in nested JARs

Jetty apparently does it differently (different version of
Jasper maybe), so you need a unique jarFileURL for each
nested JAR (previously they were all set to the parent
archive URL).

Also added the root of the main archive as a valid
document root.

For gh-367
Omit jar: prefix from jarFileUrl
For pre-initialization phase use console only

Added basic-* log configuration files that are loaded in the
beforeInitialization() phase. They don't contain any file
logger so no empty spring.log is ever created.

Fixes gh-303
Add docs on initializing a database

Fixes gh-364
Ensure shutdown endpoint is disabled by default

Fixes gh-377
Fix empty console logs with logback
Remove @ConditionalOnBean(DataSource.class) from JPA config

Stacktrace is then obviously about DataSource, not EntityManager.

Fixes gh-375
Add ServletRegistrationBean for DispatcherServlet

Mapping is exposed via server.servletPath.

Fixes gh-379
Disable JMX autoconfig by default in user tests
Participant -> Listener