Add secureProxyPorts configuration option.

The ClaimAuthFilter trusts any authentication metadata bound to a
request. A request with fake authentication claims could be forged by
an attacker and submitted to one of the Connector ports the engine is
listening on and it would blindly accept the forged information in
ClaimAuthFilter. Therefore it is vital we only accept authentication
claims from a trusted proxy.

It is incumbent upon the site administrator to dedicate specific
connector ports on which previously authenticated requests from a
trusted proxy will be sent to and to assure only a trusted proxy can
connect to that port. The site administrator must enumerate those
ports in the configuration. The ClaimAuthfilter will ignore any
request which did not originate on one of the configured secure proxy
ports.

The secureProxyPorts configuraton is a member of
FederationConfiguration.

Bug: 1964

Change-Id: Ieb1f9d464f631e5009939404d978d905e51c06a0
Signed-off-by: John Dennis <jdennis@redhat.com>
Merge "Add secureProxyPorts configuration option."