Update to latest spring-security-oauth2 module

spring-security-oauth2-2.0.0-M2 was replaced by 2.0.0-RELEASE (and subsequently by two further point releases) and the milestone release has been pulled from the global repos meaning that this will fail to build for anyone who doesn't already have that version.

(Sorry, originally submitted a pull request that only had 1/3 affected files)
This line is incorrect and potentially leads to undesired consequences: the resource server filter is explicitly left off of the default `<security:http>` tag and is instead inserted into parts of the server where needed. Servers that have more APIs to protect need to define new `<security:http>` sections and insert the resource server filter into them.