Add mechanism for per-rule filtering of matches

[bradlarsen]

There are certain rule types in particular where it would be helpful to have an expressive postprocessing/filtering mechanism. For example:

• Matches from the JWT rule could be postprocessed to decode the JWT and only keep those that have no expiration time
• Matches from PEM-encoded keys could be postprocessed to filter out matches where the payload doesn't PEM-decode