Intercept config refactor

[Cantor, Scott]

See r6818, Tom, let me know if you have any concerns.



I don't know if we talked about the messages, but there's already support 
for loading multiple message source files in services.xml, so we can put 
the intercept stuff in its own file.

The problem I had creating a user-editable parent flow for custom Event 
states was that I was putting it inside /flows where SWF actually walks 
the directory to create flows, so they can't be abstract. I just put the 
(empty) parent flow into conf/intercept for now.

Users can add end-states there for any event IDs they signal from 
intercept flows they create themselves. The ones we create we'll just keep 
in intercept-abstract-flow.xml

I'll adjust authentication and possibly c14n similarly now that I 
understand what to do. I really don't want *any* exceptions to the "don't 
touch system/" rule.

-- Scott