PLINK-408: Allow built in schemes to be overridden in AuthenticationFilter

We had to make a few judgment calls here, definitely interested in your input and happy to change things if you prefer a different approach:

* we made it possible to supply a custom HTTPAuthenticationScheme by annotating an application-provided class (or provider) with @PicketLink. We did this to match similar stuff elsewhere in PicketLink.
* we retained backward compatibility with the existing config mechanism where you name enum constants in the filter config in web.xml
* if you have a @PicketLink auth scheme *and* an auth scheme specified in web.xml, the @PicketLink bean wins. Other possibilities would have been to let the web.xml config win, or to fail with an error message. Thoughts?