(ARM-16) Manage ACLs

This provides a draft of ARM-16 - Managing
ACLs (Access Control Lists) and lays out detailed
information about how the implementation will work
for Windows.

This notes some invalid scenarios but certainly doesn't
cover all invalid scenarios. This also tries to understand
what might happen when you try to narrow a permission set
that is being inherited by an unmanaged resource (unmanaged
by Puppet that is).