High: Implement support for Pacemaker ACL schema 2.0 (bnc#894012)

This replaces the existing ACL support for schema 1.2 with
partial support for schema 2.0. All configurations previously
possible are still possible, except roles need to be defined
for all rules (rules cannot be applied directly to users).

There is no support for schema 2.0 ACL groups included in this
patch.

Note that a bug in crmsh prevents configuration of multiple
roles for a user, use of a version of crmsh where this is fixed
is necessary.