Support the use of groups to grant repository permissions.

Now, if user A can_read group B, and group B can_read repository C,
then /arvados/v1/repositories/get_all_permissions will indicate that
user A has gitolite_permissions "R" on repository C.