Document how security domain works in relation to web/ejb and both legacy security vs elytron security

There are multiple possibilities how to define security domain and how to say which way to use => some defaults might be possible to be defined as defaults in subsystems and also they can be defined in jboss descriptors or via annotations. All possibilities and what takes precedence when should be documented.

Lots of discussion on this topic can be found in [EAP7-465].