SecurityConfiguration on AbstractProfileConfiguration is SAML-specific

The OAuth/OIDC (and CAS) profile configurations typically extend the original base class hierarchy that was intended to be somewhat non-specific to SAML, but it contains a SecurityConfiguration object that is SAML-specific, complicating the redesign of the security parameters for those plugins.

We need to break this out so the OIDC SecurityConfiguration doesn’t need to inherit from this one, or split things up so it’s not SAML-specific.