Role based access for JMX.

This adds role-based access to JMX operations. Whenever a JMX operation
is invoked the roles of the current user are checked against the
required roles for this operation. This is done through a JMX
interceptor which is added through the following command line option
  -Djavax.management.builder.initial=org.apache.karaf.management.boot.KarafMBeanServerBuilder

The required roles for JMX operations are defined in configuration files
in etc/ and read via OSGi ConfigAdmin, as with any other configuration
in this location.
The relevant configuration is prefixed with jmx.acl and based on the JMX
ObjectName that it applies to. For example specific configuration for an
MBean with the following objectName: foo.bar:type=Test can be placed in
a configuration file called jmx.acl.foo.bar.Test.cfg. More generic
configuration can be placed in the domain (e.g. jmx.acl.foo.bar.cfg) or
at the top level (jmx.acl.cfg). A simple configuration file looks like
this:
  test : admin
  getVal : manager, viewer

The system looks for required roles using the following process:
The most specific configuration file/pid is tried first. E.g. in the
above example the jmx.acl.foo.bar.Test.cfg is looked at first. In this
configuration, the system looks for a:
  1. Specific match for the invocation, e.g. test(int)["17"] : role1
  2. Reg exp match for the invocation, e.g. test(int)[/[0-9]/] : role2
  In both cases the passed argument is converted to a String for the
comparison.
  If any of these match the associated roles are used.
  3. Signature match for the invocation, e.g. test(int) : role3. If
matched the associated roles are used.
  4. Method name match for the invocation, e.g. test : role4. If matched
the associated roles are used.
  5. A method name wildcard match, e.g. te* : role5. For all the
wildcard matches found in the current configuration file, the roles
associated with the longest match are used. So if you have te* and * and
the method invoked is 'test', then the roles defined with te* are used,
not the ones defined with * are used.
If no matching definition is found in the configuration file, a more
general configuration file is inspected. So jmx.acl.foo.bar.cfg is tried
next, this matches the domain of the MBean. If there is no match found
in the domain the most generic configuration file is consulted
(jmx.acl.cfg).
If a matching definition is found, this is used an the process will not
look for any other matching definitions. So the most specific definition
always takes precedence.

For some example role definitions, see the following example
configurations:
jmx.acl.org.apache.karaf.services.cfg a very simple configuration:
  list : viewer

jmx.acl.org.apache.karaf.bundles.cfg, a more advanced configuration, e.g.
bundles 0-49 can only be stopped by an admin, others can be stopped my a
manager:
  stop(java.lang.String)[/([1-4])?[0-9]/] : admin
  stop : manager

jmx.acl.cfg a catchall configuration for invocations of any MBean that
don't have a rule specified elsewhere:
  get* : viewer
  set* : admin
  * : admin