Make single definition of defaultRolePrefix and rolePrefix

[eddumelendez]

Previous to this commit, role prefix had to be set in every class
causing repetition. Now, bean GrantedAuthorityDefaults can be used to
define the role prefix in a single point.

Fixes gh-3701

[eddumelendez]

@rwinch is it ok to replace all classes involved in this commit? Early feedback is welcome. Thanks in advance.

[rwinch]

@eddumelendez Thanks for the PR! I think I'd prefer that any of the domain object avoid adding ApplicationContextAware. Instead, the configuration specific classes would try to detect the default role prefix and then set that on the domain object. This decouples the way the defaults are provided from the domain object and keeps the logic in the configuration.

[eddumelendez]

@rwinch Thanks for feedback.

I think I'd prefer that any of the domain object avoid adding ApplicationContextAware

Just to clarify, you meant RoleVoter, right?

[rwinch]

@eddumelendez Thanks for the fast response.

I mean unless a class is in the spring-security-config module this PR should not add implements ApplicationContextAware to it. Some examples of classes that should NOT implement ApplicationContextAware are: Jsr250MethodSecurityMetadataSource, SecurityExpressionRoot, DefaultMethodSecurityExpressionHandler, RunAsManagerImpl, RoleVoter, JdbcDaoImpl, etc.

For now we should not add GrantedAuthorityDefaults to any of these classes either (instead just invoke the setter for default role prefix on each object).

[eddumelendez]

@rwinch PR has been updated

[rwinch]

Thanks for the PR! This is merged via eabeaf3 I applied some Polish in b443bae for your review. The main goal was to continue with the suggestion from #3956 (comment)