Add Mongoid::Criterion::Permission

This is a workaround for Mongo bug [SECURITY-90].

An unscrupulous attacker can pass a structured query parameter
where you are expecting a string.

e.g.

    // Add index on user email.
    User.index email: 1

    // Safe looking query.
    user = User.where(email: params[:email]).first

    // Expected input
    ?email=me@cirw.in

    // Unindexable input
    ?email[size]=1

You can easily use this to denial of service anyone with a moderately
large user's table.

Signed-off-by: Arthur Neves <arthurnn@gmail.com>
Update Changelog

Also cleanup some comments