LPS-33779 PACL - register trusted protection domains as early as possible
LPS-33779 PACL - make sure they stay in sync on refesh
LPS-33779 PACL - we're using a weak map so we might have to try getting it from the root map which is not weak
LPS-33779 PACL - don't create a PortalPermissionCollection when there is no PACLPolicy, this also means it should be trusted
LPS-33779 PACL - SF
LPS-33779 SF