Hierarchical resources.

Add support for granting roles on resources that contain other
resources. Permissions on a containing resource are conferred onto
the contained resources. Containment relations are traversed through
Resource.ParentOf(). Added new Futurama test case and improved existing
ones. Made the group service resource a container over all groups.