[GR-57827] Move the initialization of security providers from build time to run time and place it behind the --future-defaults flag.

[graalvmbot]

Motivation:
Currently, security providers are initialized at build time, which leads to several unwanted side effects, such as pulling unnecessary objects into the image heap and snapshotting values from the builder's JVM... (see #8674 and #5950). The only aspect related to the provider that still needs to happen at build time is provider verification. Since we can now initialize a class twice in Native Image (once at build time and again at run time), this gives us the opportunity to move their initialization to run time.

Code Walkthrough:

• Remove fields that were holding provider objects in the image heap (and thus initialized at build time). Move all JDK providers (that can be moved) to runtime initialization (see SecurityServicesFeature.java).
• Allow the loading of security providers via the service loading mechanism (see ServiceLoaderFeature.java).
• Use a separate structure to support provider verification (see SecurityProvidersSupport), avoiding the need to keep provider objects in the image heap (see SecuritySubstitutions).
• Allow the instantiation of the security provider at run-time by modifying substitutions in SecuritySubstitutions.
• Remove the build-time initialization of XMLDSigRI from TrustStoreManager.
• Update SecurityServiceTest to align with the new changes.
• Add a CHANGELOG.md entry.

Note: The feature is now hidden behind the --future-defaults=all or --future-defaults=run-time-initialized-jdk flag (take a look here for more details).