Add /error to ignored paths for security autoconfig

Protecting /error doesn't make a great deal of sense and if it is
protected you don't get the ErrorPageFilter for the attempt at loading
it, so Tomcat renders its own HTML error page (when deployed as WAR).

Fixes gh-1548
Blitz some more special characters from the metric names

When MVC path matchers are used as metric keys, they can still contain
invalid characters and patterns (like asterisks). This change removes
some more special characters and also tidies up the names a bit so
no key part starts or ends with "-" (which is ugly).

Fixes gh-1528
Merge branch '1.1.x'
Update docs on metrics names
Merge branch '1.1.x'