Improve architecture to better fit in with Spring Security:
* Create an unauthenticated token first and pass it to an
  AuthenticationProvider.
* Let Spring Security handle everything else.

Correctly wire up UserService and set the stored, encrypted password so
it is available for comparison.

* AuthenticationProvider-agnostic User object allows access to common
  user attributes: userId, loginId, authProvider, etc.
* Auto-create UserProfiles for external accounts
* Use userId (instead of loginId) for permission checks
* Use custom implementation for Pac4j integration
  (remove org.pac4j.spring-security-pac4j)
* Move authentication logic from controller to service layer
* Remove user room role handling
* Rename targetDomainType 'session' to 'room'

PathApiVersionContentNegotiationStrategy selects the media type based on
request path. It allows to set the correct media type for old clients
which do not set the 'Accept' header.

The new class CouchDbInitializer is using CouchDbConnector as a
dependency instead of inheriting from it. This way, circular
dependencies can be avoided.

Classes can register reasons for maintenance. While at least one reason
is set, all requests are blocked and responded to with a 503 status
code.

Jackson cannot instantiate non-static inner classes for deserialization.

Use `authProvider` + `loginId` instead of `username`.

Since VisitedRoom does not extend Entity, @JsonProperty has to be set
explicitly for id.

Moved PI timer logic to its own service. The implementation for room
owner changes has been removed for now.

A new service, repository and entity have been introduced to handle file
attachments to other entities. Attachments store meta data about the
file. The file upload is not yet implemented. It is planned to abstract
the storage handling to allow the support for different storage
solutions (local file system, database, cloud).

Additionally moved previously missed v2 entities to the v2 package.

Introduced content groups which replace question variants and support
sorting.