Restricting what classes the web application sees.

Previously, we were using the classloader of this Maven plugin as the parent of the web application classloader. We were blacklisting some classes that are causing conflicts with Jenkins, but this is a catch-up game that you can never win.

A better way to do this is by white-listing. We'll only let the web application see the servlet classes (and other JCP APIs if there's any, such as JSP and JSTL related ones.), then delegate straight to JavaSE. Note that for this to work, those exposed APIs must not have any visible dependencies to other non-exported classes. I believe APIs do satisfy that constraints.

The immediate motivation of this was the Jenkow plugin, which required Xalan 2.7.5-ish, whereas this plugin was exposing Xalan 2.6.0