Refactor to allow for only one WebSecurityConfigurerAdapter

This refactor was needed as the prior code did not fully support the 'combined' approach with both local-users and preauth. In the previous iteration, 2 WebSecurityConfigurerAdapters and as a result, 2 HttpSecurity instances would have been registered, only one having any affect (typically the preauth, but not guarantees).

There is now only one WebSecurityConfigurerAdapter, whose sole purpose is to collect all HttpSecurityAmenders and execute their callback at the right time.  Te existing WebSecurityConfiguration classes for both profiles have been retrofitted to produce HttpSecurityAmenders that perform the desired behavior. The test cases provided in the sample-war have been updated to provide 2 combined test paths:

* 1 that has both profiles active, but demonstrates how fallback to HTTP Basic works, and
* 1 that has both profiles active, and includes the simulation filter to produce a successful preauthentication.