refactor: add QueryFilter - pre/post param validate, and post query
filter; move original filters to 'http filter'; move
acl/policy/ResponseDecorate to query filters, and this filter can
support service such as 'limit/forbidden domain' policy.
move policy to query filter package.