Externalize security policy config and add plugin interface for it

The SecurityPolicies element in the configuration should be converted into a plugin point, and the defaults moved into a separate file. Access to the policy options should be converted to use the plugin API.