Remove unneeded 2nd values() call in sets and tags api
Add access checks to Forms api

* Override _resource() and centralise loading the
  form for get/put/post/delete requests
* Implemente resource interface in Form model
Share code between Form create and update.
Reduce duplication of groups/attributes handling in Forms API

Keep group and attribute objects after validation and the loop through
them to save. Previously object were discarded after validation
and recreated to save leaving room for errors and mismatches in values
set.
Allow reusing existing attributes during form creation.
API forms/:id/group/:id/attributes - forward attribute creation to /attributes api

Use HMVC to pass request on to /attributes API
Refactor Groups and Attributes API to share code between PUT and POST request
Add access checks to Attributes API, abstract model loading to _resource()

* add get_resource_id to attribute model
Add access/scope checks to Groups API, abstract model loading to _resource()
Add tests for revisions/translations/updates access when parent post is draft
Ensure API enpoints default to access denied

This is to ensure we always have to whitelist who has access, and that
resources, and scopes default to closed if someone forgets.
Restrict access to posts based on parent_id

* Add RelationValue, RelationAllowed and Combined Asserts
* Rename ArgumentStatic assert to Value
* Use RelationAllowed assert to check we're allowed to access parent post
* Move parent_id check to Posts::_resource() rather than duplicate for
  updates/translations/revisions
* Make _resource the parent if no post_id passed - this ensures an
  access check for the parent if we're getting all children