Add 'oa_access' module for generic Group/Team-based permissions

This used by [oa_workbench_access](https://github.com/phase2/oa_workbench) (sub-module of [oa_workbench](https://github.com/phase2/oa_profile2)) and oa_profile2.

It's fully SimpleTest'ed and ready to go!

Please let me know what you think.