Improve AuthorizationManager configuration error messages

[Spikhalskiy]

Users that are migrating from Spring 5.x don't know that the AuthorizationManager is turned on by default in 6.x and incompatible with their existing Access Decision Manager configuration.
This improvement to the error message with help to bring their attention to the relevant option that is true by default. It will also prevent them from wasting time and looking at where they implement or wire an AuthorizationManager instance.

Closes #16193

[Spikhalskiy]

Please feel free to advise if there is a more colloquial format for such additional information in the error messages in Spring framework

[jzheaux]

Referring to #16193 (comment), this message is only shown for XML support, so I'm not concerned about there being a conflict. Also, the existing message already uses XML-specific language (use-expressions="true").

I think that an error message should "speak the language" so the remediation is more quickly understood. If the same kind of thing exists in Java Config, that exception message would be different and refer to configuration files, for example.

Unless there is a common situation where a developer would be confused by seeing <http>, I would vote to keep it in the message.

Another possibility would be something like this:

AuthorizationManager and AccessDecisionManager cannot be used at the same time; either remove `access-decision-manager-ref` or add `use-authorization-manager="false"`

I don't think we need to let them know in the error message what the defaults are. We use documentation and IDE support for that. Instead, we should tell them what to do to get up and going again.

Does that address your concern?

[Spikhalskiy]

This totally makes sense; thank you for the advice. I adjusted the messages, please let me know if they look better.