Enable pass-through of authz ctx to hbase (1/x)

The idea behind this and follow up commits is to enable Lily to pass on an authorization context to a hbase-based authorization framework by NGDATA (not part of the OSS Lily DR).

 * define a thread-local based authorization context holder
 * wrap tables in AuthEnabledHTable to make sure authz context is passed on to hbase for each request
 * testcase

introduces a dependency on lily-hbase-authz-public-client which is not yet publicly available but will be soon.

not yet / todo: make the same work for the remoterepository, i.o.w. modify rpc protocol to pass on authz context
Use branch-specific artifact version
Add hbase-authz-public-client

These are some client helper classes to interact with the NGDATA hbase authorization layer.
Fix lily-hbase-authz-public-client dep
add extra client attrs for hbase-authz

Introduce some extra attributes that the AuthEnabledHTable passes on to the authorization coprocessor.

Some code refactoring.
Do not add nv recordtype kv twice

put.add will happily record the same KV multiple times. This can be annoying/confusing on the hbase side (e.g. in coprocessors).
Adjust permission format

Adjust permission format in DEFAULT_PERSSIONS to the new syntax expected by hbase-authz.
change security label things

Security labels are now a single string, and are now stored in a column familiy + qualifier selected by the application on a per table basis, the name of the CF&Q is stored in the table descriptor.
The setSecurityLabel method had become absurdly trivial, so removed it.
javadoc clarifications
add source artefacts to build, install and deploy to nexus
removing snapshot repository
Add constant for lily.sec.label.encoding
LILY-2524 Add utility for subtype checks

This is similar to RecordUtil.instanceOf, but takes two types as argument, thus it is a is-subtype check rather than an instance-of check.
forward-port repository changes from master
fix version in hbase-authz-public-client
Set artifact version to base version in repository to be used by lily runtime. That is because the actual version could be a resolved snapshot, while lily runtime can only work with artifact versions that correspond exactly to the version referenced in the directory name and classloader.xml (hence literally SNAPSHOT).
updated repository wrt changes in mvnrepo setup
HBaseAuthzUtil: add lily.sec.filterputs

Define a new request attribute which allows to tell the authorization layer whether for puts, columns for which there is no permission should be silently skipped or cause an exception to be thrown.
LILY-2508 changes for delete authorization

Made the necessary changes for making the Lily DR delete operation behave correctly in case the NGDATA hbase authorization coprocessor is active:
 * the read-before-write of the delete operation should read all fields, not only the ones to which the current user has permission (because we don't want to end up with half-deleted records).
 * we don't support deleting records with versioned(-mutable) fields when authorization is active, because this case is split into two HBase operations, and we need the authorization for both to succeed. Since we can't do this atomically, and thus this would leave the record in a half-deleted state, I decided to disallow this case for now.
LILY-2548 authz for remoterepo & lilyclient

Make RemoteRepository and LilyClient authorization aware:
 * RemoteRepository performs its direct hbase reads using the AuthEnabledHTable
 * LilyClient can take an optional AuthorizationContextProvider constructor argument. By default the DRAuthorizationContextProvider is used which takes it from the threadlocal var managed by AuthorizationContextHolder.

(all this stuff is only relevant when NGDATA's hbase authorization coprocessor is deployed within HBase)