mon/MonCap: revise grammar

 allow rwx
 allow service rwx
 allow profile foo
 allow command bar
 allow command bar with k1=v1 k2=v2

Signed-off-by: Sage Weil <sage@inktank.com>
mon/MonCap: define a few profiles

 - osd, mds, mon (daemons)
 - fs-client (can mount fs)
 - simple-rados-client (can use existing rados pools)

Signed-off-by: Sage Weil <sage@inktank.com>
vstart.sh: use new mon cap profiles

Signed-off-by: Sage Weil <sage@inktank.com>
mon/MonCap: debug is_capable

Signed-off-by: Sage Weil <sage@inktank.com>
mon/MonCap: fix is_capable()

Explicitly allow_all.

Fix rwxa enforcement flow.

Signed-off-by: Sage Weil <sage@inktank.com>
mon/MonCap: add bootstrap-{mds,osd} profiles

Use simple profile cap, and then whitelist the specific things that
are needed for bootstrap in MonCap.cc (which more sophisticated argument
validation).

Signed-off-by: Sage Weil <sage@inktank.com>
mon/MonCap: pass entity_name_t into is_capable()

We will have some profile operations dependent on who the actor is.

Signed-off-by: Sage Weil <sage@inktank.com>
mon/MonCap: allow daemons access to config-keys $name/*

With tests.

Signed-off-by: Sage Weil <sage@inktank.com>