Attempt to fix orphaned classAces

Attempt ot fix orphaned classAces, as described in #9. Class Aces are now identified by a field 'class'. Acl finder now additionally queries for class type to get all aces for an oid. There are also some changes in hydrateObjectIdentities. Because the entries are first identified by their objectIdentity ids, I added an additional step that adds the classAces for each object. I am not sure I got all the parts where parent aces, are set though, so there migth be missing something.
Tests pass, but since several cases are never ecplicitly tested, this doesn't mean everything works. What's missing generally is testing the general Security layer with the MongoDBAclProvider.