Extract actuator security into separate classes

So spring-security + a web app is secure by default
(you don't need the actuator).

spring-boot-cli/src/test/java/org/springframework/boot/cli/ReproIntegrationTests.java

@@ -44,8 +44,7 @@ public class ReproIntegrationTests {
 	@Test
 	public void securityDependencies() throws Exception {
 		this.cli.run("secure.groovy");
-		assertThat(this.cli.getHttpOutput(),
-				containsString("{\"message\":\"Hello World\"}"));
+		assertThat(this.cli.getOutput(), containsString("Hello World"));
 	}
 
 	@Test