refactor: extract abstract superclass

This can be reused for the GuestPass-based security manager.
It also helps to keep test class sizes down, which makes PMD happy :)
make GuestPass a final class, instead of finalising each method, and add toString
migrate to TestNG and use data providers for GuestPass

This allows us to increase the number of test cases without making PMD complain :)
make wrapped permission in GuestPass accessible to simplify tests

No need to hide it completely; protected access is fine.