[documentation] Clarify AllowedChars vs. DeniedCharactersRegex in README

[larskn]

The README states that the default config is DeniedCharactersRegex = @"[^a-zA-Z0-9\-\._]"; but looking at the source code this is not true, the default setting is a list of AllowedChars (it matches the specified regex but it is a difference, which I discovered while looking into #22 ). I think this should be clarified.

Also I noticed that in the unit tests the DeniedCharactersRegex is labeled as "Legacy".
Is AllowedChars now there preferred way of configuration?
The README doesn't mention AllowedChars at all.

[ctolkien]

I suspect we've broken this in the migration to V3...