Activation Criteria for Attribute resolvers

[Rod Widdowson]

> One Q: does the AttributeRecipientContext include access to the data
> that's been resolved up to that point?

No, that would be the AttributeResolutionContext.  The
AttributeRecipientContext is the temporary bucket I invented to hold all the
"external" stuff that the Resolution and filtering needs, stuff like
Principal, IdP EntityId, SP entityID, AuthenticationMethod and so on.

The reason I chose that context was that because a large number of the
Attribute Filters are really more interested in that than the
AttributeFilterContext and so it was easy to see how to make a filter fit
the role of a criterion by making them just consume that.

If we think that the resolution criteria will need to look at the current
state of the resolution context then we "just" need to give the Function the
AttributeResolutionContext.  Wiring in the "sensible" filters as criteria
becomes slightly more complex, but not unduly so.

Rod