Tentative support for the new type of ACL configuration in pacemaker 1.1.12

There are a few things I'm not sure about:

- Feature detection, what to do if given a configuration with old user assignment..
- Should the new role be called something else to differentiate?
- Documentation needs a lot of work.