Use spring-security-bom and other minor improvements.