Subflow branching based on LOA

# Summary
This pull presents the basic scaffolding required for subflow branching based on the loa parameter. It also presents the appropriate UI for the second-factor authentication and is able to construct the CAS workflow in absence or presence of the loa parameter. 

In case the loa parameter is specified,
* The first authentication screen requires a match between username/password
* The second authentication screen requires the hardcoded `casuser/Mellon` credentials. This is just to demonstrate that authentication mechanisms are different and is done to economically take advantage of the same login screen and Spring webflow action for form authentication. 

The UI presents some useful data notably authenticated netid and the loa level and the configuration demonstrates how model objects can be transferred from flows to subflows back and forth. The second level of authentication, although it currently presents yet another form, can easily be tweaked to require other forms of credentials, such as OTPT. 

The configuration model easily allows for extending the authentication workflow to many other additional authentication factors and levels if/when required. 

# Configuration
The multi-factor authentication is handled by the addition of a new SWF Action that for the most part mimics the behavior of `AuthenticationViaFormAction` of CAS. It detects the nature of the CAS service and reroutes calls appropriately. 

The CAS dispatcher servlet is modified to load the new mfa-servlet.xml context file. This was done in an attempt to remove the `cas-servlet.xml` file from the overlay to reduce configuration overhead. It later turned out that the flow registries are also configured in the cas-servlet.xml file and the file is in fact required for the registration of mfa subflow definitions. 

Note: webflow definitions in the registry can be specified using regex pattern which could in theory remove the `cas-servlet.xml` from the overlay because flow definition xml files no longer need to physically be present. However, defining regex patterns for flow definitions can be tricky in the way SWF wants to auto-configure the id of each newly discovered xml file. Didn't spend much time looking into this issue as it seemed to be of little importance to the scope, but nonetheless is something to think about. 

# TODO
What needs to be done still, is the detection of an existing SSO session and enforcing MFA based on the existence of loa parameter.