Add configurations to define ACLs for upload

[LukasKalbertodt]

Fixes #477
Fixes #478

A review from @wsmirnow would be appreciated to make sure this system is powerful enough for the customer systems you manage. Your adjustments here should be simple: just take the default ACL template and add the part you added in the linked commit.

This change of yours was a bit more tricky as it required values taken from user roles. But I think with this PR, we can achieve the same effect with this ACL template:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<Policy PolicyId="episodeACL"
  RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit-overrides"
  Version="2.0"
  xmlns="urn:oasis:names:tc:xacml:2.0:policy:schema:os">
  {{ #defaultReadRoles }}
    <Rule RuleId="{{ . }}_read_Permit" Effect="Permit">
      <Target>
        <Actions>
          <Action>
            <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
              <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
                DataType="http://www.w3.org/2001/XMLSchema#string"/>
            </ActionMatch>
          </Action>
        </Actions>
      </Target>
      <Condition>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">{{ . }}</AttributeValue>
          <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role"
            DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </Apply>
      </Condition>
    </Rule>
  {{ /defaultReadRoles }}
  {{ #defaultWriteRoles }}
    <Rule RuleId="{{ . }}_write_Permit" Effect="Permit">
      <Target>
        <Actions>
          <Action>
            <ActionMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
              <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">write</AttributeValue>
              <ActionAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id"
                DataType="http://www.w3.org/2001/XMLSchema#string"/>
            </ActionMatch>
          </Action>
        </Actions>
      </Target>
      <Condition>
        <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-is-in">
          <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">{{ . }}</AttributeValue>
          <SubjectAttributeDesignator AttributeId="urn:oasis:names:tc:xacml:2.0:subject:role"
            DataType="http://www.w3.org/2001/XMLSchema#string"/>
        </Apply>
      </Condition>
    </Rule>
  {{ /defaultWriteRoles }}
  <Rule RuleId="DenyRule" Effect="Deny"/>
</Policy>

(Note that the {{ #foo }} bar{{ . }}baz {{ /foo }} syntax repeats bar{{ . }}baz for every element in foo, with {{ . }} replace by that element.)

[wsmirnow]

If you define an ACL template block like this:

{{ #ltiCourseId }} <my acl here>{{ . }} <other block> {{ /ltiCourseId }}

and the user serve studio not from an LTI session. The ltiCourseId will be undefined. Will the block dissappear in the produced ACL or does the process fail?

[LukasKalbertodt]

Will the block dissappear in the produced ACL or does the process fail?

@wsmirnow The block will disappear. See this part of the Mustache documentation. So these {{ #foo }} ... {{ /foo }} blocks completely disappear if foo is false, undefined, an empty list or other "falsy" values.

[wsmirnow]

I'm fine with it. Good job.