On Abstain Access Should be Denied

[rwinch]

We should look in every location and require that if an authorization manager abstained, then access should be denied. One option is that if the AuthorizationResult is null, then deny access. Another option is to require AuthorizationResult to be non-null going forward.

This depends on:

• RequestMatcherDelegatingAuthorizationManager should deny when no match #11958
• Consider XML and Java support to simplify migration to filter-based default deny #11967