Major change to permissions. Previousy PermissionStrategy defined behaviour to either check that user had all permissions supplied or just one of them. It turns out we never actually needed REQUIRE_ALL_PERMISSIONS and a use case has arisen that requires a change to the meaning of PermisionStrategy enum. Now it defines whether implied permissions are traversed and used to determine the assertion outcome.

This allows us to have implied permissions that are not used as part of certain checks. The first example of this is in MenuService where we only want to show a menu if the permission was directly applied to a users role.