in, spring-security-core-tiger-2.0.4.jar/META-INF/MANIFEST.MF, and in the Import-Package section, one can see :
i.e. the import package constraints accepts only the 2.0.3.RELEASE version of the core security bundle.
This way, the annotations bundle ver. 2.0.4 WILL NOT work as is with the core security bundle of the same version in an OSGi environment.
By the way, the version hosted in the "SpringSource Enterprise Bundle Repository" does have a correct manifest (well, with an A qualifier).
I would suggest upgrading the constraints to 2.0.4, or evenen to relax it to something like [2.0.3, 2.1.0).