Put security-related APIs that clients need in the "o.a.a.core.client" package, or a security sub-package

This is a pretty straight-forward task. This is just to consolidate more "public API" stuff in a convenient location for client code.