Move the manage permission out of the wildcard match="#" security-setting and into a dedicated match="activemq.management.#" entry, along with the supporting permissions required for management operations (createNonDurableQueue, deleteNonDurableQueue, createAddress, deleteAddress, consume, send).

The old placement was imprecise: granting manage across all addresses is broader than necessary, since it is only meaningful on the management address.
The stale comment explaining the wildcard manage entry is also removed.

Changes:

• artemis-cli broker.xml template
• artemis-features artemis.xml
• jmx-rbac-broker-security smoke-test fixture (aligned to new default)
• ArtemisTest:add testDefaultSecuritySettings to assert the generated broker.xml has manage only on activemq.management.# and not on #