Split users and groups for permission query

Put ldap validation in a single function to resue in authorization.
Tested:
1. LDAP:
    GET /users?_user_id=a_valid_user_id
    GET /users?_user_id=invalid_user_id
    GET /groups
2. PAM:
    GET /users
    GET /groups

Signed-off-by: Royce Lv <lvroyce@linux.vnet.ibm.com>
Move validation to authorizaiton

Put validation in user and group class instead of validate
in metadata update, so that different type of authorization
can use their own authentication to validate input value.

Signed-off-by: Royce Lv <lvroyce@linux.vnet.ibm.com>
change vm permission tag

Add authorization type to vm tag, and update set/retrieve access
tag accordingly.
So that we can switch between different types of authentication.

Signed-off-by: Royce Lv <lvroyce@linux.vnet.ibm.com>
Update test model for authentication and authorization

As test model includes test against pam user/group listing,
using pam authentication instead of fake authentication.
Also change test cases which used fake user/group update
to use pam user validation and update.

Signed-off-by: Royce Lv <lvroyce@linux.vnet.ibm.com>