Speed up ACL check for rules #2823

We use mass-querying into database to drastically minimze the count of query
when a user has a lot of roles. This means that from now on, ACL is strictly
on persisted objects. We cannot check ACL for non-persisted user/role/user-role.
Speed up rule validation #2823

We only need to count usage, not actually load the entire collection,
so we mark entity as extra lazy to avoid loading a huge quantity of
useless objects
Avoid duplicated SQL queries when building rule structure #2823