Attribute Filter predicates

[Rod Widdowson]

As discussed last week I started ploughing into the AttributeFilter
predicates yesterday.  

I pretty immediately ran into a small design hole, I shall not go into it
here since it requires that you have both the old and new designs (or rather
the new design and the old configuration language) in your head

I have documented it, and my proposed solution at the bottom of
https://wiki.shibboleth.net/confluence/display/IDP30/Attribute+Filtering+Eng
ine  ("Separating <PolicyRequirementRule/> from <AttributeRule/>")

Although this is written up as if it has been implemented the work has only
been partially done (enough that I am happy that it works).  So now is a
good time to demur if you disagree.  I'd be particularly interested in
Scott's input since the SP shared the same filtering language and therefore
has had to address the same issues.

Thanks

Rod