CAS-1238 Initial API support for multi-factor authentication.

All components that deal with authentication now accept a varargs array
of credentials:

1. CentralAuthenticationSerivce#createTicketGrantingTicket()
2. CentralAuthenticationSerivce#grantServiceTicket() (renew form only)
3. CentralAuthenticationSerivce#delegateTicketGrantingTicket()
4. AuthenticationManager

The use of varargs Credentials provides call compatibility with 3.x
components while supporting the requisite inputs (multiple credentials)
for multi-factor use cases.
CAS-1238 Add authentication policy into ticket granting and validation.

The AuthenticationPolicyFactory interface provides a way to inject stateful
authentication policies into the ticket granting and validation pipeline.
CentralAuthenticationServiceImpl methods have been modified for operations
that involve authentication to produce authentication policies based on
service + registered service data whereby the policy must be satisfied in
order for tickets to be issued and validated.

In order to support credential upgrade scenarios
(e.g. forced authentication), a getSupplementalAuthentications() method
has been added to TicketGrantingTicket to store _all_ authentications that
occur on a ticket during an SSO session, including forced ones. In that way
authentication policies can evaluate against not only the first but all
subsequent authentications to find an authentication event that satisfies
the security policy.
CAS-1238 Develop authn policy driven by registered service meta data.

Enhanced RegisteredService with getRequiredHandlers() getter to define
the set of authentication handlers that must successfully authenticate
credentials in order to access the corresponding service.
RequiredHandlerAuthenticationPolicyFactory is the corresponding policy
component injected into CentralAuthenticationServiceImpl to enforce the
security constraints.

AutenticationPolicy was extended to ContextualAuthenticationPolicy so it
exposes the context information used to drive the policy. This provides an
easy facility to retrieve and store the context information in
UnsatisfiedAuthenticationPolicyException on policy failure. In this way
the context information could be exposed to higher layers of the
application in order to route the user to detailed error views that could
provide suggestions for corrective action.
CAS-1238 Expose policy on UnsatisfiedAuthenticationPolicyException.
CAS-1238 Add MFA unit test for credential upgrade via renew case.

Demonstrate that it is possible to satisfy authentication policy for an
SSO session where the credential authenticated at SSO session start is
insufficient but upon granting a service ticket via renew with stronger
credentials the security policy can be satisfied.
CAS-1238 Ensure authentication in ticket assertion satisfies sec policy.

The "primaryAssertion" field in the assertion must contain the
authentication event that satisfies security policy in order to support the
use case where the ticket validation response contains information to
indicate security policy was satisfied.

SuccessfulHandlerMetaDataPopulator provides a simple means to support
sending back handler names in the ticket validation response which could be
the basis of a simple policy check on the client side.
CAS-1238 Javadoc improvements inspired by @apetro.
CAS-1238 Respond to @apetro code review.
CAS-1238 Add documentation to emphasize need for unique handler name.
CAS-1238 PolicyBasedAuthenticationManager unit tests and policy tweaks.

Unit tests revealed need for tryAll flag on
RequiredHandlerAuthenticationPolicy. Explicitly set tryAll flag to false
on all policies that have it to emphasize "off by default."
CAS-1238 Remove authentication policy check on granting PGT.

In the absence of a use case for applying policy checks to service
credentials, as happens with delegateTicketGrantingTicket, the safest
behavior is to avoid security policy enforcement altogether. If
requirements come to light, we should have some guidance on how to proceed
in this case.
Merge pull request #265 from serac/mfa

CAS-1238 MFA Support
CAS-1238 Credential refactoring.

1. Rename Credentials -> Credential for clarity w/r/t MFA.
2. Move Credential up to authentication package since it is a core
   authentication component.
3. Add Credential#getId() so that credentials that are safe for long-term
   storage can simply implement both Credential and CredentialMetaData and
   consequent be stored directly in HandlerResult.
CAS-1238 Revert PasswordCredential to UsernamePasswordCredential.
Merge pull request #268 from serac/credentials

Credential refactoring, Credentials -> Credential, for code clarity and adherence to vocabulary of NIST 800-63.
Merge branch 'feature-new-authn-api' into SPNG-LDAP-REMOVAL

Conflicts:
	cas-server-support-ldap/src/main/java/org/jasig/cas/adaptors/ldap/BindLdapAuthenticationHandler.java
	cas-server-support-ldap/src/main/java/org/jasig/cas/adaptors/ldap/FastBindLdapAuthenticationHandler.java
	cas-server-support-ldap/src/main/java/org/jasig/cas/adaptors/ldap/remote/RemoteIpLookupCredentialsToPrincipalResolver.java
	cas-server-support-ldap/src/main/java/org/jasig/cas/authentication/principal/CredentialsToLDAPAttributePrincipalResolver.java
	cas-server-support-ldap/src/test/java/org/jasig/cas/adaptors/ldap/BindLdapAuthenticationHandlerTests.java
	cas-server-support-ldap/src/test/java/org/jasig/cas/adaptors/ldap/FastBindLdapAuthenticationHandlerTests.java
	cas-server-support-ldap/src/test/java/org/jasig/cas/authentication/principal/CredentialsToLDAPAttributePrincipalResolverTests.java