Allow modules to modify security filters list

This behavior is still occurring on the latest dev.

This problems stems from ckeditor_filter_xss(), which is called when CKEditor is loaded. It gets a list of $format_filters and $security_filters for the input_format, and applies them when the editor is loaded.

This is different from the way that Drupal core is designed to handle input formats. Core's approach is to allow users to input content relatively unmolested (save SQL injection sanitization) and then filter the value upon display. If a user were to re-edit the content, they'd see the original input in the textarea. CKEditor does not follow this approach, and thereby creates a very confusing editor experience.

Take this scenario as an example:

• admin enters invalid html (an img tag without an alt attribute) into ckeditor and clicks save
• a formatter recognizes that the img tag is invalid and does not display it
• the admin realizes that his/her code is not working as expected and re-edits the node
• the entire img tag is now missing from the editor. no warning/error was displayed, and their content has disappeared

These filters should not be applied when CKEditor loads. A few suggestions for ways to make this configurable:

• Introduce a variable that would allow security filters to be toggled off
• Introduce an alter hook that would allow security filters to be selectively manipulated (E.g., unset)

Committed and pushed. Thanks!