entitlements scheme proposal

add EntitlementsTest
record entitlement context for REST web requests, and log more info of web requests
add AcmeEntitlementManagerTest
add isEntitled check to ApplicationResource and EntityResource
add unauthorized to WebResourceUtils
add FROM_ENTITY function to EntityTransformer
add EntitlementPredicates
this may be invoked from places where no entitlement context is known, such as the CLI or tests.  all REST calls when properly configured with authentication will have an entitlement context set, however, so it is safe (and normal) for global entitlements managers to simply return true in this case.

@andreaturli can you note that in the javadoc, and that implementers must be prepared for this case