REIVEW: [NX-518] Orient database manager

This PR addresses the following issues:

https://issues.sonatype.org/browse/NX-518
https://issues.sonatype.org/browse/NX-519
https://issues.sonatype.org/browse/NX-542
That's not quite as safe as checking the record has the right class (or using the generated id approach) because it would still be technically possible to forge a CapabilityIdentity that mapped onto a record that wasn't a capability (it's just harder to do so because of the per-class secret-key but not impossible).