`management.security` null check no longer applies

[snicoll]

Previously, the Security instance in ManagementProperties was only created if Spring Security is on the classpath. We've changed that in #3888

The side effect is that we have such check in EndpointWebMvcManagementContextConfiguration (and possibly others) that we need to replace by something that checks if Spring Security is present.