(PUP-2184) Remove ACE with optional elements

This allows someone to specify less specific elements
when attempting to ensure that certain explicit
permissions are not added to an ACL. This is done by
using `remove_match_any` to the elements (except identity)
where a user wants to be less specific about ACEs that
contain that identity.

An example would be `{ identity=>'Administrator', rights =>
['remove_match_any'], type=> 'remove_match_any', child_types
=>'remove_match_any', affects=>'remove_match_any' }` which
would match any explicit permission matching the identity
'Administrator'. For a less specific match `{ identity=>
'Administrator', rights =>['remove_match_any'] }`, would
only match 'Administrator' with `type=>'allow'` (default),
`child_types => 'all'` (default), and `affects=>'all'`
(default).

With this change, we will evalutate rights as they are
specified unless set specifically to 'remove_match_any'.