Remove Duo source from CAS-MFA code

[jtgasper3]

Duo code does not belong in CAS-MFAS. It puts an unrealistic burden upon the project to publish updates when Duo changes the internal workings of their code as they recently did. We don't do this for hibernate, spring etc, code. Why do it for Duo?

One of two things (and probably both) should happen:

1. Provide an example of how to configure the maven overlay to compile the duo source and package the static assets as source-based customizations to CAS which is truly how Duo wants it treated.
2. We publish the bits under a standalone library/war, but within our namespace. And put a big disclaimer that this is not an official library. I'd even add a line of static class initialization code that writes something to stdout that says as much. Then this package is referenced in the CAS-MFA' Duo pom.xml as "provided" so it is available for compile-time referencing, etc, but not formally included. Then folks can either do point 1 or add a reference to this item (point 2), but it is a formal decision on their part.

[jtgasper3]

I know this may not be a popular opinion, but I'm requesting this in the mindset of a library owner/maintainer and not an consulting implementor. During client implementations, the client should be asked to contact Duo and read the provided prompt about why they have to compile Duo source instead of using compiled libraries. :)