Remote devtools endpoint cannot be accessed if actuator and spring security are on the classpath

[mbhave]

managementSecurityFilterChain does not have an explicit order and will override the securityFilterChain in RemoteDevtoolsSecurityConfiguration. We should probably order managementSecurityFilterChain with BASIC_AUTH_ORDER.

[philwebb]

Closing in favor of PR #25868