Place for beans related to metadata providers?

[Brent Putman]

Other than conf/global.xml, is there currently any other logical place
for beans that would be injected into metadata providers?  Looking for a
place to wire in the placeholder default criteria for signature
validation, mostly to give users an easy-to-edit way to
whitelist/blacklist algorithms.   To make things easier, I default in a
well-known bean name in the parser if it's not explicitly supplied, so I
have to put something somewhere.

For now I'll put in conf/global.xml, but we can move as appropriate.