Updated test cases w.r.t to review meeting with Peter Walsh and @dnahodi...

...l.

Broadly:

* changed application of "protection" to be at the project level, rather than at the release level (as this is what the policy actually states);
* added explicit test cases for filtering (as this has been the source of some bugs in the past).
I think these tests could potentially be made a bit more succinct and clear doing something like: http://spock-framework.readthedocs.org/en/latest/data_driven_testing.html

i.e. there's a lot of repetition in here, with just some inputs and expected outputs changing.

Reviewer, let me know what you think!