entitlements scheme proposal

add EntitlementsTest
record entitlement context for REST web requests, and log more info of web requests
add AcmeEntitlementManagerTest
add isEntitled check to ApplicationResource and EntityResource
add unauthorized to WebResourceUtils
add FROM_ENTITY function to EntityTransformer
add EntitlementPredicates
For CLI, why would context be null? We can find which user is logged in and we can indicate that it's called from CLI.
For tests, that should never (if at all possible) drive an `@Nullable` on non-test code.