Refs #6760: Validator to ensure associations are authorized.

My goal was to create the validator and an example model as a starting place prior to attempting full coverage.

Please see for a test scenario - http://projects.theforeman.org/issues/6760
Also, a corresponding beginning usage in Katello - https://github.com/Katello/katello/pull/4483

The idea is to define what resources a model is associated to that should be checked upon association and the permission that corresponds. There is the possibility that this may need to be evolved for derived permissions (e.g. in Katello repositories derive their permissions from Products).
@ehelms, nitpik, I would use `Location.scoped` instead of `Location.all` since `.all` returns an Array where `.scoped` returns `ActiveRecord::Relation` that can be chained where an Array cannot be chained.