fixes #5780 - API v2 - RESTful way to add/remove many-to-many association one at a time rather than passing all id's

Note: Related to PR https://github.com/theforeman/foreman/pull/1773 to add auditing when adding/removing
@isratrade, what about this suggestion:
I was thinking about the permissions model in the system, and I think that with a little effort in extending the permissions module, we can create a cleaner solution.
In the current code the smallest granule for permissions is `#controller/#action` pair. I suggest using the request URL and HTTP verb as a permissions granule, and use a "shortest match" search for each request to find the appropriate permission. I'll show you what I mean:
Let's say I want to GET /architectures/5/links/operatingsystems
the system will try to see if my user has a valid permission like this:
if I have permission to GET, /achitectures/* => return allow, else:
if I have permission to GET, /achitectures/*/links/* => return allow, else:
if I have permission to GET, /achitectures/*/links/operatingsystems => return allow, else: deny.

@ares, You are way more familiar with the authorization mechanism in the system, what do you think? Is it doable? Am I on the right track?