Add support to define security provider with a reference to a config file location

The big advantage of this is that the configuration file can be added to the app server installation, the configuration can then reference it relative to a known location within the app server installation.

This will be the first step to move on from requiring the configuration to be global at the JVM level.

Note: Dependencies may be an issue unless we can work out a way for services that depend on a specific provider to set the dependency.

In addition to being able to specify the class name of the provider we will also need to be able to specify a module.