Add character blocking filter

Add a `RequestParameterPolicyEnforcementFilter` for blocking unexpected characters in request parameters.

This Filter is documented in the accompanying updates to `README.md`, in its JavaDoc, and in a comprehensive JUnit test with [TestDox-style][] test method names.

The intent of the Filter is to be suitable for fronting Java CAS Client implementations of all kinds for blocking certain characters in certain request parameters as a workaround for preventing attempts to exploit CVE-2014-4172 .  This is intended as an alternative to upgrading or switching Java CAS Client versions and implementations in environments where that version or client jump is undesirable for the complexity it may introduce.

The Filter is optionally configurable via `web.xml` `init-param`s.  Most adopters will need to configure it to scrutinize only the CAS protocol request parameters as documented in the `README.md`.

The Filter also optionally blocks multi-valued request parameters, making it a suitable alternative to the `SecurityFilter` in this project for those situations where blocking all multi-valued request parameters is over-broad.

The Filter has no external dependencies and so should be deployable in any Java Servlet web application environment that supports Filters.  This makes this Filter potentially suitable as a workaround for very old CAS client environments including those using third party or even custom CAS Client implementations.

[TestDox-style]: http://googletesting.blogspot.com/2007/02/tott-naming-unit-tests-responsibly.html
As documented in the unit test `testRejectsRequestWithIllicitCharacterInCheckedParameter()` and as documented in the class JavaDoc

> The default set of characters disallowed is percent, hash, question mark, and ampersand.

and as documented in the accompanying `README.md`

    ### charactersToForbid init-param
   
    The _optional_ init-param `charactersToForbid` is a whitespace-delimited set of the individual characters the Filter will forbid.
    
    The special magic value of exactly `none` instructs the Filter not to forbid any characters. (This is useful for 
    using the Filter to block multi-valued-ness of parameters without sniffing on any characters.)
    
    If not present, the Filter will default to forbidding the characters `? # & %` .

the default behavior is to check all request parameters, forbidding all multi-valued parameters and all parameters containing `?` `#` `&` or `%`.