I then noticed that ESB 4.7 provides this functionality in the BaseWebService (I have still to try it on 4.7).
You are spot on. This was added for the 4.7 release by this jira.
Is upgrading to 4.7 an option for you? If it is please try your use case with ESB 4.7.
I tried WS-security using ebws on 4.7 and it worked.