Add ability to grant granting to subtrees

In other words, someone who now has PERMISSION_GRANT with an argument of
"PERMISSION_GRANT/foo.*" is allowed to grant PERMISSION_GRANT but only
on "foo.*" arguments.