Add read/write granularity to role based ACL

This patch adds 2 new configuration directive for ressource and item
ALLOWED_ROLES configuration parameter, global and per resource.
This allows for instance to require a role for writing but not for
reading.