Considerations for Application-Specific Security Firewalls

## Considerations for Application-Specific Security Firewalls

### Acceptance Criteria
1. [x] Each firewall in `$app['security.firewalls']` is prefixed with `base.` to prevent the application-specific code from accidentally overwriting the base firewalls.
1. ~~$app['security.access_rules'] is defined as an empty array so that the application can simply extend it.~~
1. [x] `/oauth` and `/social-login` endpoints have more specific `RequestMatchers` to allow passthrough where needed and access to the authenticated user where needed on anonymous endpoints.
1. [x] The firewall setup allows the application-specific code to simply extend `$app['security.firewalls']`, and all `base.*` firewalls fall at the **end** of the firewall order.