Issue #5909 - Better handling of merged RoleInfo during omitted method constraints

[janbartel]

Arises from #5909

We found some code in combining security-constraints that has existed at least since Jetty was brought over into Eclipse (circa 2009?) that wasn't correct, and which then had another bug introduced in 2009.

When RoleInfo is combined from security-constraints with either http-method-omissions or without any http-methods, the code:

• failed to merge the auth-constraint roles
• incorrectly switched the sense of whether the request needs to be authenticated

[gregw]

@lachlan-roberts read up on what http-method-omissions is about. It is really rather bizarre!

[lachlan-roberts]

Shouldn't _roles.addAll(other._roles) be done in the other._isAnyRole == true case as well?

In ConstraintSecurityHandler.configureRoleInfo() it is done like that.

if (mapping.getConstraint().isAnyRole())
{
    // * means matches any defined role
    for (String role : _roles)
    {
        ri.addRole(role);
    }
    ri.setAnyRole(true);
}

[lachlan-roberts]

LGTM