Separate submitted and response salts in UI filters

[snoopdave]

Roller's UI CSRF protection uses two salt filters: one checks the token
submitted with a request, the other generates the token for the next response.
This change gives each filter a single responsibility and corrects the order in
which they run.

What changed

• Validate and consume the salt value submitted with the request.
• Run validation before the response-salt filter; mint the fresh response salt
  only after a successful validation, and terminate rejected POSTs without a
  replacement token.
• Defer multipart *.rol validation to an interceptor that runs immediately
  after the upload interceptor, and reject non-Struts multipart requests that
  lack a submitted token.
• Remove the salt.ignored.urls setting and its isIgnoredURL() helper, which
  did not match the shipped values correctly.

Tests

• A request without a valid submitted salt is rejected; one valid token
  succeeds once and a second use of the same token fails.
• Filter ordering validates before response-token generation.
• Successful POSTs that render forms receive a new response token.
• Multipart actions accept one valid token and reject missing, invalid, and
  already-used tokens, exercised on the supported Tomcat deployment and the
  repository Jetty test setup.