Fix #324: Move ACL back-end manipulations from bucket / key to acl objects

See #324.
The word `dirty` didn't immediately make the purpose of the variable clear to me.

IIUC, this is used to determine whether a change should occur? The reason for `dirty` is that in cases we patch the local data, it becomes `dirty` hence should be re-saved?