Allow no security header in certain use-cases

This task is to allow no security header in certain use-cases. Currently an error is thrown:

javax.xml.ws.soap.SOAPFaultException: javax.xml.stream.XMLStreamException: org.apache.wss4j.common.ext.WSSecurityException: Security header is missing
at org.apache.wss4j.stax.impl.processor.input.SecurityHeaderInputProcessor.processNextEvent(SecurityHeaderInputProcessor.java:160)

Two use-cases that come to mind are:

a) A SupportingToken policy that is "AlwaysToRecipient" with no binding. In this case, the service response could have no security header, which is completely valid + the client should treat it as such.
b) A SOAP Fault is received. Here we want to process the fault and so we should at least fail at the security policy validation stage.