feat(rest): expose authorization checks in REST

related to #CAM-960
Merge branch 'master' of github.com:camunda/camunda-bpm-platform
feat(auth): use authorization system in webapp

- BRAKING CHANGE: move engine authentication thread local to identity
  service instance to make it process engine scoped. Internal access is
  provided through CommandContext

- Add ResourceAuthorizationProvider SPI allowing to create default
  authorizations as Resources are created

- make sure resourceId-scoped authentications are deleted when the
  resource instance is deleted

- Add SecurityActions in webapp allowing to write authenticated closures

- refactor create initial user

related to #CAM-1023
feat(rest): provide dedicated Authorization Errors

- add dedicated handling of authorization exceptions in REST API

related to CAM-1036
feat(webapps): dedicated authorization exceptions

- provide dedicated error message if request is Forbidden.

related to #CAM-1023
feat(rest): add auth operation links in user&group

- add set of links for authorized operations for user & group

related to #CAM-1040
feat(webapp): make UI authorization aware

2 mechanisms:
- explicit check for authorization through "show-if-authorized" directive
- evaluate available operations links provided in #CAM-1036

related to #CAM-1023
Merge branch 'master' of github.com:camunda/camunda-bpm-platform