[appserver-io/appserver] Configuration included in apps must be restricted

[wick-ed]

Currently (and in the future) a lot of configuration should be able to be packaged within an app. A webapp might e.g. include its own virtual host configuration. This is generally different than a virtual host for the same webapp which is configured on server side as an admin might not have the same influence on the configuration.

UAC:

• Configuration packages by webapps MUST be restricted for security reasons
• Server security configuration MUST NOT be weakend by webapp included configurations
• Non webapp included app configuration MUST NOT be restricted the same way
• Restriction policies SHOULD be configurable

[wagnert]

Restriction policies are now part of issue #863.