vfs: introduce AclCheckable interface to VirtualFileSystem

the interface going to solve two issues:

  - filesystem implementation and ACL are not always the same component
  - decouple PseudoFS from Chimera implementation

The filesystem implementation, navertheless, have to provide
corresponding AclCheckable implementation.

For convenience, three basic implementations are provided:

  - ALLOW_ALL
  - DENY_ALL
  - UNDEFINED_ALL

Acked-by: Paul Millar
Target: master