entitlements scheme proposal

add EntitlementsTest
record entitlement context for REST web requests, and log more info of web requests
add AcmeEntitlementManagerTest
add isEntitled check to ApplicationResource and EntityResource
add unauthorized to WebResourceUtils
add FROM_ENTITY function to EntityTransformer
add EntitlementPredicates
whatever initiates the outermost activity needs to set the `EntitlementContext` on a task or other `ThreadLocal`.  for REST calls there is a clear temporal wrap around this.

but for other calls there is not.  there is not even any identifiable user logged in at that point.  e.g. if when launching we've said to launch `--app Foo` ... so i think it is another (big) chunk of work to apply entitlements to contexts other than REST.

we could have some logic which says `if (threadLocalEntitlementContext==null) then use SystemEntitlementContext` but that feels messy, I'd rather say it's null for now, and then in time perhaps find a way to say something better