MODE-2004 Access control checks only occur in repositories that have ACLs

Implemented this by adding an "accessControl" boolean field in the
repository's metadata document. The field is "false" by default, but
is changed to "true" as soon as the first ACL is created and added to
a node in the repository (any workspace). This means that for any
repository that does not use ACLs, there is almost no overhead to the
ACL checks. However, as soon as the first ACL is created, then from
that point forward all permission checks look for ACLs on the
specified node or any of its ancestors.

RepositoryCache was also changed to efficiently expose this setting
to other components: the JcrSession class was changed to use it to
determine if the ACLs should even be checked, while
AccessControlManagerImpl was changed to set this value to true when
ACLs are created. (RepositoryCache only updates the metadata document
if the value is different from its existing value, and notification
of the changes is propagated to other nodes in the cluster.)
MODE-2004 Update the logic that reads/writes the repository metadata document

Per code review, the method that does this work needed some improvements
to make it work correctly in a highly-concurrent scenario.