Introduce BucketAccessControlTemplate

This would make the Bucket Acceess Control API constistent with other GCS access controls.
nit unless we expect this to be extended, I'd make it final and hide the ctor and fields.