Use separate capability for cacheable security realms

This would eliminate the need for a runtime type check which can abort services starting which actually could be quite late.

One issue however is realms already have a separate capability to represent if they are modifiable so this could lead to more permutations of custom and custom modifiable realms - this may be fine but worth double checking.