Add read/write granularity to role based ACL

This patch adds 2 new configuration directive for ressource and item ALLOWED_ROLES configuration parameter, global and per resource. This allows for instance to require a role for writing but not for reading.