#5467 $allowed_actions

Two year old patch from @mateusz, ported to SS3: http://open.silverstripe.org/ticket/5467
From what I can tell, doesn't fix security issues as such, only clarifies misunderstandings on more complex $allowed_actions rules. It does raise a good point about dealing with private/protected actions, and adds UTs to verify the problem.

Needs peer review by at least one other core team member, given how central this code is to security.
From my perspective, we should hold off with this until 3.1 (= merge into master once we've branched off 3.0).