(Collections) Initial collections work

Initial collections work.

TODO:

* Take care of some TODO's in the code
* Self-review
* Activity
* Searching collections (search permission integration is complete though)
Discussed this one on IRC:

```
simong
I was gonna ask about why we had to re-use the group identifier for collections

simong
As I can't remember and I'm not seeing immediately why we we have to

mrvisser
simong: I think it was because the permissions propagation has to transfer naturally through groups

mrvisser
through collections that is. while you can't make collections members of collections, you can still have groups as members of collections. if we didn't have this, we would need to do 2 queries for every time we currently do 1

simong
In what area is that?

mrvisser
what do you mean in what area is it?

simong
I don't see where'd we have to do 2 queries rather than 1

mrvisser
lets say we put x:oae:... in the Authz tables

mrvisser
now when we usually query g:... to get group memberships, we now have to query both g:... and x:... to get them all

mrvisser
and then we have a mix of them in AuthzMembershipsCache

mrvisser
differentiation between groups and collections is needed mostly when building the library indexes, in which case we're fetching those entities anyways, and can just omit the ones that don't exist from the expected table (Collections or Principals)

simong
Ah right, now I see it

mrvisser
I did a scan of activity, and I'm pretty sure we can actually just maintain the current associations as well

mrvisser
"members" associations will pass through the collections entries in Authz naturally and I'm pretty sure it makes sense

simong
cool
```