Move channel manager security model implementation to hst-core

The point is that if we want to use the security model in downstream projects during integration tests, I do not want to have to pull in the hst pagecomposer (and hst jaxrs as a result)