Service ACL support

This PR adds the framework to support ACLs around service registration and discovery. The ACL language is extended to add the new `service` keyword to specify policy for services. The policy language supports the "deny", "read" and "write" levels for services. This allows it to be used to support ACLs on discovery. This PR adds support only for the write enforcement during service registration however.

Fixes #465.