CAS-1365: Access rules to the management webapp are externalized.

Instead of having adopters tweak the xml file, by default an external file is provided
that can list the user accounts who may have access to the webapp. This appears to
moderately address use cases better in situations where ldap or jdbc backends are not
available or may not be at all needed.

https://issues.jasig.org/browse/CAS-1365