Store users in ACLs as QJsonObjects instead of <ID, type> pairs.

Allows full user data to be requested with AclOperation with expand=1
request parameter.