access policy editor: "Add" button for explicitly adding new rows

The current behaviour is to add a new row as soon as a typeahead
completion is made. That's problematic because typeahead.js doesn't have
an official way to indicate if a match has been made, and the current
hack does not work when the typed value matches a suggestion that was
not in the prefetch. It is also subject to a race if the user blurs the
input before the typeahead suggestions have been displayed.

With this patch the typeahead is treated purely as a suggestion (which
is the way it is intended to be used), it's up to the user to enter or
select the right value and then click Add or press Enter to add the row
to the policy. If they enter a non-existent user or group we show an
error when they attempt to save the policy.

Change-Id: I4b5284a36d2a6d63748e89494abf854ee86b8dde
define a 'remote' for group typeahead instead of relying on prefetch

If the set of groups in Beaker has changed since it was prefetched, new
groups would never appear in the suggestions even when they were typed.
Now the group typeahead will always fetch fresh suggestions.

Bug: 1076322
Change-Id: I36122bfd6dde2b50394d4962de43bdf5e2bea11f