Excludes applied on @ImportAutoConfiguration are not consistently applied

[snicoll]

Excludes applied on AutoConfigurationImportSelector implementations (@EnableAutoConfiguration or @ImportAutoConfiguration) are only applied for the auto-configurations they're locally importing. They don't exclude anything added by another import.

Fixing this requires fixing #12366 first

[snicoll]

To fix this one we probably need to expand what AutoConfigurationGroup does by calling a dedicated method that keeps track of what was retrieved for each instance of the group, applying the excludes and filtering at the very end. This also means that one event would be fired (rather than one per annotation at the moment). We could also keep firing separate events if we kept track of the instance of the selector though this is not really interesting (compared to the root class where the annotation was added).

[snicoll]

Interesting side effect. If you're running a test with @SpringBootTest and @AutoConfigureMockMvc and you've excluded Spring Security, the security applies anyway as the mock mvc auto-config is secured by default and imports the security bits again.