Cleanup for permissions assigned to 'all'

* When granting or revoking, treat 'all' as a group
* Fix typo that prevented revocation from working for 'all'
* Update `accumulate_grants/2` to pull grants assigned to 'all'
* Block admins from using 'all' as a user or group

Ancillary change, but useful for verifying above and for admins:

* Display grants to a group or user separate from inherited

/cc @Vagabond