Post set api

Initial Implementation to fix issue #57 

- List posts within a set
- Add existing post to a set
- Delete post from a set
- Behat test for listing all post attached to a set
- Behat test for finding a particular post attached to a set
- Behat test for removing a post attached to a set 
- Behat test for adding a post to a set

Next writing necessary doc for the resource.

Todo: ACL rules to match these conditions
* [x] A user can only see posts in a set that they would normally see through the posts API.
* [ ] A user can only see a post in a set (ie. /sets/1/posts/10) if they have access to both the set and the post.
* [ ] Admins can add/remove posts from any set.
* [ ] Users can add/remove posts from their own sets.
* [ ] Users can not add/remove posts from other users sets (even if they're public).
* [ ] Guests can't create or change sets at all.
* [ ] Add state flag to indicate the state of a set. Public / Private.
* [ ] Add state of a set to API response.
ping @rjmackay or @kamaulynder for a code review