add positional token anchors and regex options

* can now anchor tokens to a specific position or to a range of
positions in addition to just anchoring to the beginning or end
* add --regex-only and --regex-never to filter password guesses
* bumped version to 0.4.0