Spike on authority rules and enforcers

For: https://www.pivotaltracker.com/story/show/45770559

I think there is now enough in here that the story this is for could be considered "done".  I don't know if there is enough in here that we can call permissions in general "done", but I think it's a starting point.

Permissions are built as Rules objects that take an actor (user) and a subject (usually an ActiveRecord object, could be anything).  We then ask those rules if we can perform an action.

I've defined the rules we need for editions taking into account the scheme described in [the access control spreadseet](https://docs.google.com/a/digital.cabinet-office.gov.uk/spreadsheet/ccc?key=0AtVh0hUglzwCdGlnT1p6XzdIUGZsRW52azJYRlFhY3c#gid=0) (Cell ref A5:F26).  E.g. access limiting, fatality handling and world location stuff.

I've been working on this for a while so I may have missed some things so a fresh set of eyes on the code and the story would be appreciated.