add security tests

[Ladicek]

We need at least these common scenarios covered:

• HTTP Basic authn / RBAC authz with users/passwords/roles embedded in application.properties
• token-based authn / RBAC authz with MP JWT (token issued programmatically)
• token-based authn / RBAC authz with Keycloak (Keycloak only issues and verifies tokens)
• token-based authn / URL-based authz with Keycloak (Keycloak handles everything)

We should also have tests for HTTPS:

• 1way TLS
• 2way TLS: client cert presence
• 2way TLS: client cert authn and RBAC authz

The HTTPS tests are a bit harder to run on OpenShift, so we can leave them as local for now.

[Ladicek]

The remaining test, 2way TLS: client cert authn and RBAC authz, is blocked on quarkusio/quarkus#8508. I filed #16 for it. The major part of security-related tests is done, so closing this.