Add an operation to security domains that takes a username and shows the resulting SecurityIdentity

[darranl]

This will allow testing of configuration.

For realms that can't obtain an AuthorizationIdentity we could optionally support attributes on this method to test the name rewriting and role decoding / mapping.

We could even go as far as adding an implies equivalent to test a permission.