Move setup of composite security configurations to SecurityProviderBuilder

stillalex, while working on OAK-7010 I noticed that tests in oak-auth-external and oak-authorization-cug use a similar way to plug additional security configurations into the SecurityProvider. Now that we have the SecurityProviderBuilder I think that we might be able to avoid that 'duplication' by adding another method to the builder and setup the composite configurations when creating the SecurityProvider.