[WW-5186]protect excludedClasses and excludedPackageNames

[k4n5ha0]

block unknow exp to clean excludedPackageNames and excludedClasses if attacker use 'excluded'+'PackageNames' likes blow, this patch can protect structs

%{
(#request.a=#@org.apache.commons.collections.BeanMap@{}) +
(#request.a.setBean(#request.get('struts.valueStack')) == true) +
(#request.b=#@org.apache.commons.collections.BeanMap@{}) +
(#request.b.setBean(#request.get('a').get('context'))) +
(#request.c=#@org.apache.commons.collections.BeanMap@{}) +
(#request.c.setBean(#request.get('b').get('memberAccess'))) +
(#request.get('c').put('excluded'+'PackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet())) +
(#request.get('c').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet())) +
(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'calc'}))
}

[coveralls]

Coverage increased (+0.003%) to 50.637% when pulling 3a7cc3db62dc914ea47d94539d549c2ee2791c91 on k4n5ha0:patch-7 into 4b3ee53f939ac040b6d5351591eace6023d78514 on apache:master.