Set execute bit on test runner scripts
Allow access control function to be replaced

The current access control function `can_translate` is not always
sufficient.  For instance, some projects require access to translation
to be controlled using a permission rather than using groups.

This change introduces a new setting `ROSETTA_ACCESS_CONTROL_FUNCTION`
that allows an alternative predicate to be specified.  The default is to
use the current function so this change is backwards compatible.
merged @tangentlabs PR to handle more advanced permission mechanisms