Provide a DSL for access constraints

[abstratt]

Current syntax is based on building a collection of constraints via function calls:

            constraint(
                roles(Administrator::class),
                can(*ALL_CAPABILITIES)
            ),
            constraint(
                roles(Employee::class),
                can(Read, List)
            ),
            constraint(
                roles(Employee::class),
                can(Update),
                provided { instance, role ->  role == instance.employee || role is Approver }
            ),
            constraint(
                    Expense::date,
                    roles(Employee::class),
                    can(Read, Update),
                    provided { instance , role ->  role == instance.employee }
            ),
            constraint(
                    Expense::review,
                    roles(Employee::class),
                    can(Call),
                    provided { instance, role ->  role == instance.employee }
            )
    )```