refactor(plugin-security): move what start() registers after the authorization middleware out of security-plugin.ts (#25223 cut 13)

refactor(plugin-security): move what start() registers after the authorization middleware out of security-plugin.ts (#25223 cut 13) #36317