SEC-2151: Support binding method arguments with Annotations

This allow utilizing method arguments for method access control on
interfaces prior to JDK 8.

config/src/test/groovy/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.groovy

@@ -166,4 +166,37 @@ public class GlobalMethodSecurityConfigurationTests extends BaseSpringSpec {
             grantAccess
         }
     }
+
+    def "Method Security supports annotations on interface parameter names"() {
+        setup:
+            SecurityContextHolder.getContext().setAuthentication(
+                new TestingAuthenticationToken("user", "password","ROLE_USER"))
+            loadConfig(MethodSecurityServiceConfig)
+            MethodSecurityService service = context.getBean(MethodSecurityService)
+        when: "service with annotated argument"
+            service.postAnnotation('deny')
+        then: "properly throws AccessDeniedException"
+            thrown(AccessDeniedException)
+        when: "service with annotated argument"
+            service.postAnnotation('grant')
+        then: "properly throws AccessDeniedException"
+            noExceptionThrown()
+    }
+
+    @Configuration
+    @EnableGlobalMethodSecurity(prePostEnabled = true)
+    static class MethodSecurityServiceConfig extends GlobalMethodSecurityConfiguration {
+
+        @Override
+        protected void registerAuthentication(AuthenticationManagerBuilder auth)
+                throws Exception {
+            auth
+                .inMemoryAuthentication()
+        }
+
+        @Bean
+        public MethodSecurityService service() {
+            new MethodSecurityServiceImpl()
+        }
+    }
 }

config/src/test/groovy/org/springframework/security/config/annotation/method/configuration/MethodSecurityService.groovy

@@ -19,6 +19,7 @@ import javax.annotation.security.DenyAll
 import javax.annotation.security.PermitAll;
 
 import org.springframework.security.access.annotation.Secured
+import org.springframework.security.access.method.P
 import org.springframework.security.access.prepost.PostAuthorize;
 import org.springframework.security.access.prepost.PreAuthorize
 import org.springframework.security.core.Authentication
@@ -55,4 +56,7 @@ public interface MethodSecurityService {
 
     @PostAuthorize("hasPermission(#object,'read')")
     public String postHasPermission(String object);
+
+    @PostAuthorize("#o?.contains('grant')")
+    public String postAnnotation(@P("o") String object);
 }

config/src/test/groovy/org/springframework/security/config/annotation/method/configuration/MethodSecurityServiceImpl.groovy

@@ -69,4 +69,9 @@ public class MethodSecurityServiceImpl implements MethodSecurityService {
     public String postHasPermission(String object) {
         return null;
     }
+
+    @Override
+    public String postAnnotation(String object) {
+        return null;
+    }
 }