Nested @RolesAllowed

[t1]

We already can control access to queries and resolvers simply with standard @RolesAllowed et.al. annotations. As discussed in #860, there are situations where the fields of some POJO need access control; i.e. a User class having fields for the name, etc., and a lastLoginTimestamp, which only a user in the admin role is allowed to read and a system allowed to write. The @RolesAllowed annotation would have to be placed on the getter or setter respectively (it's target is limited to TYPE and METHOD).