(Collections) Initial collections work

Initial collections work.

TODO:

* Take care of some TODO's in the code
* Self-review
* Activity
* Searching collections (search permission integration is complete though)
I think this is being tested, and the invalidation scenarios are based on the same as the `AuthzMembershipsCache`. I'll double-check the test you're looking for and the `_updateRoles` case.