Do not provide Privileges to ControllerAction constructors

Instead, provide them via a separate accessor. The ControllerAction can
then be meaningfully constructed without having any linked privileges.
Boyscout: improve factoring of Arrthorizer::Rails::Configuration

It is now easier to a) insert a fake configuration when testing and b)
change the configuration file location. Refs #18