REIVEW: [NX-518] Orient database manager

This PR addresses the following issues:

https://issues.sonatype.org/browse/NX-518
https://issues.sonatype.org/browse/NX-519
https://issues.sonatype.org/browse/NX-542
hopefully this is cheap. if not, i wonder if we can just rationalize a weaker form of obfuscation. presumably records that are supposed to be inaccessible by a given user are not possible for them to retrieve even if they know the id. provided we've got an appropriate authZ layer in place.