Simplified, improved RBAC storage backend.

Replaced rbac storage API with a simpler interface that will be easier
to implement over more backends (RDBMS, kv-stores, flat files, etc.).
Low-level storage is a simple knowledge base inspired by triplestores.

Groups as well as role grants can all be expressed in terms of this
simple storage API.

Updated the in-memory and MongoDB backends to implement the new storage
interface.

Relocate the storage implementations under rbac/storage. They're not
storage for anything else.
Added rbac.Admin.RemoveAll, RevokeAll.

Updated GroupService, demo, and provided servers to new rbac API
changes.
Error message, string formatting conventions.

Lowercase error messages, they may be appended.
Using %q instead of %s or %v in message strings.
Using %s instead of %v for fmt.Sprintf with string args.
Eliminate '.' imports in non-test source files.

Also added a checkstyle script to detect this.
Fixed a compile error in group/client, when lowercasing error messages.
Replace gopass with go.crypto/ssh terminal.
Refactor Principal to a simple struct.

Flatten the identity model. Group membership will need to be provided by
a new GroupScheme interface.
Rename rbac/store.go to rbac/facts.go.

This file is more about a low-level knowledge base used for solving
access control and membership as much as it is about storage.
Remove GroupScheme, add GroupFacts.IsGroup.

Leaving adaptation to a provider's external grouping for future
development. It could be done better by a hybrid GroupFacts than in a
provider. Adding capability to test if a principal is a group.
Merge branch 'principal_refactor' into cmars_master

Resolved Conflicts:
	cmd/affinity/serve.go
	examples/openid-demo/main.go
	providers/common/openid.go
	providers/usso/scheme.go