Configurable limiting framework

Scope
* store limits in DB
* apply limits to objects (this seems to be explicitly out of scope for this story)
* support notification of limit changes to registered objects (aka Lifecycle limiting)
* configure via REST API
* control access via standard ACL

Out of Scope
* refactor existing limiting to use new framework

Guiding Principles
* limits are heirarchical, with potential for absent links in the chain
* at the system and domain-scoped level, there are default limits that apply unless more specifically configured
* dependent limits are constrained by parent hard limits (also on change of hard limits)
* each limit has a name - limit names are not configurable (they are customisable with product releases) and are stored for referential integrity

Acceptance Criteria
* Given that I am a super user, when I configure a system hard limit to a valid value that is not less than any current system default limit, per-domain (default or hard) or per-pair (default or hard) limits of the same name, then I expect the limit to be applied and that no dependent limit values are modified.
* Given that I am a super user, when I configure a system hard limit to a valid value that is less than a current dependent limit of the same name, then I expect the limit to be applied and that each dependent limit value is modified to match the new system hard limit.
* Given that I am a super user, when I configure a system hard limit to an invalid value, then I expect to be informed that the request is invalid and that the change will not be honoured.
* Given that I am not a super user, when I configure a system hard limit, then I expect to be informed that I am unauthorised to do so and that the change will not be honoured.
* Given that I am a super user, when I configure a domain-scoped hard limit to a valid value that is not less than any per-domain default limit or per-pair limit, then I expect the limit to be applied and that no dependent limit values are modified.
* Given that I am a super user, when I configure a per-domain hard limit to a valid value that is less than a current dependent limit of the same name, then I expect the limit to be applied and that each dependent limit value is modified to match the new per-domain hard limit.
* Given that I am a super user, when I configure a per-domain hard limit to an invalid value, then I expect to be informed that the request is invalid and that the change will not be honoured.
* Given that I am not a super user, when I configure a per-domain hard limit, then I expect to be informed that I am unauthorised to do so and that the change will not be honoured.
* Given that there is a system default limit for an action, and that there is no domain-scoped default limit, and that there is no pair-scoped limit, when an action related to that pair is exercised which exceeds the system default limit, then the action should fail.
* Given that there is a domain-scoped default limit for an action, and that there is no pair-scoped limit, when an action related to that pair is exercised which exceeds the domain-scoped default limit, then the action should fail.
* Given that there is a domain-scoped default limit for an action, and that there is no pair-scoped limit, when a valid action related to that pair is exercised which exceeds the system default limit but not the domain-scoped default limit, then the action should succeed.
* Given that there is a domain-scoped default limit for an action, and that there is no pair-scoped limit, when a valid action related to that pair is exercised which does not exceed the domain-scoped or system default limit, then the action should succeed.
* Given that there is a pair-scoped limit for an action, when a valid action related to that pair is exercised which does not exceed the pair-scoped limit, then the action should succeed.
* Given that there is a pair-scoped limit for an action, when a valid action related to that pair is exercised which exceeds the pair-scoped limit, then the action should be rejected and be able to ascertain the cause of the failure.