Allow Rule to carry around a hash of options.

This does 3 things.

* Extracts a private `match` method for more reusability.
* Allows a `CanCan::Rule` to carry a hash of options around.
* When a match is found but it doesn't allow access, that match is also provided to CanCan::AccessDenied.