Add a command line tool for linting ACLs

[arteymix]

TODO

• ensure that a securable entity has an object identity
• ensure that parent objects are attached to existing entities
•  look for objects with missing ACEs:
  • an object should have at least one entry or inherit at least one entry from its parent
  • an object should have at least one entry that grants all permission to GROUP_ADMIN
• look for dangling ACLs that can be removed
• propose corrective actions for common issues

This is useful for identifying issues such as those reported in #994.

[arteymix]

We don't assign ACEs on entities that inherit permissions from their parent, so we can add that check to the linter.