Rework security to use javax.annotation.security

[mvysny]

We should drop the non-standard eu.vaadinonkotlin.security.* annotations in favor of javax.annotation.security.* annotations. This will help us in the future when we'll move to Vaadin 21+ AccessAnnotationChecker #71 .

Namely:

• eu.vaadinonkotlin.security.AllowRoles is replaced by javax.annotation.security.RolesAllowed
• eu.vaadinonkotlin.security.AllowAll has no replacement in javax.annotation.security and is replaced by Vaadin 21+'s com.vaadin.flow.server.auth.AnonymousAllowed.
• eu.vaadinonkotlin.security.AllowAllUsers is replaced by javax.annotation.security.PermitAll (@PermitAll requires an user to be logged in)

[mvysny]

Reopening since eu.vaadinonkotlin.security.AllowAll still needs to be replaced by com.vaadin.flow.server.auth.AnonymousAllowed. However, that's blocked by #72

[mvysny]

Also update the security.md documentation.