Improve AuditEventRepository

[vpavic]

I've recently had some requirements on reporting/handling audit events (which included retrieving the latest events on the system, retrieving events of a specific type for a given user), so it seemed fit to consider the expansion of AuditEventRepository.

Investigating the default implementation (InMemoryAuditEventRepository) the following things didn't sit well with me:

• InMemoryAuditEventRepository#find(String, Date) allows null principal to be used as wildcard for finding events for all users (which is even more confusing considering the fact that AuditEvent constructor allows null principal, but that's another story) rather than using separate find operation
• InMemoryAuditEventRepository#add operation allows passing null events, which effectively breaks the aforementioned find operation since it relies on null values to indicate the end of its internal circular buffer

This PR adds the following changes to improve the situation:

• add dedicated operation to AuditEventRepository for retrieving events without filtering by principal
• add dedicated operation to AuditEventRepository for retrieving events filtered by principal and type of event
• validate InMemoryAuditEventRepository#add input to prevent nulls
• validate construction of AuditEvent to prevent null principals
• improve AuditEvent test coverage

Further improvements to consider:

• name AuditEventRepository finders to describe use case (this could include deprecating current find)
• remove InMemoryAuditEventRepository#setCapacity and enforce setting capacity only via constructor (note that using setCapacity drops the current buffer if used in runtime)
• use object instead of method synchronization in InMemoryAuditEventRepository
• introduce a global value for an unknown principal (see AuthorizationAuditListener:50)

Thoughts?

• I have signed the CLA

[philwebb]

Looking at these changes a little more, I'm worried that we're going to break back compatibility if we drop support for calling find with null parameters. I've updated the Javadoc for AuditEventRepository to say that null values are allowed (and what they mean) and updated InMemoryAuditEventRepository to support them.

[wilkinsona]

3ba2b24 lost all of the synchronization improvements. It would be nice to keep those.

[snicoll]

Sorry about that Andy. I just realized the mistake I've made 😶

[wilkinsona]

I'm going to take care of the synchronisation changes in #6261

[vpavic]

Thanks for merging this! 👍