Security URL properties handling

Defect Tracker #24196: Security URL properties are currently a mess in that there are three properties, clientToken, credentials, and trustedPayload that are all eventually treated at the trustedPayload. This is not desirable. Instead we should pass all of the connection properties to the membership service (as a map) for access by membership domains. This would remove the need to specifically pass the trustedPayload and application name as parameters. This could also be done for connectors provided that the message or the transport containing the connection properties is encrypted.