Implements a new permission level PERMS_PENDING

((Warning: I have tested this now, but not systematically every possible scenario. I now took care of the javascript and the API functions. Also I should have mentioned before that line 1332 of zot.php is changed in a way that will alter behaviour, because as I understood not excluding pending channels for perms_contacts was a bug.))

With this a user can allow some action to any user which connects
to them, even before they've connected back.

Ref.
https://mobiliza.org.br/display/478d9e71eaf55748dc646d3990651d6d34cfb7db5c38360538ec730ca3ccf908@zothub.com

Also some code cleanup and an alternative logic for handling
notifications of permission changes in zot.php.

This assumes that private posts are still restricted to people in
your addressbook. Regardless of your global permissions, a
pending channel won't get private posts, even if the post
only has a deny clause not matching the pending channel.