Extract application permissions from a drools file and into Java code.

This is in preparation for the move to CDI.
Testing of this pull request must ensure that the same level of permissions in the drools file is still maintained. The drools file is still kept for reference. It may be removed after this pull request is QA'd and merged.
This problem appeared in security.drl too, but considering you have to be admin to view an obsolete project or iteration, why is it that anyone who creates a version group should be able to view obsolete version groups?