Implement ACLs

(filter, not handler.)

Some notes that I'm braindumping here for lack of a more-relevant place:

Since filters are plugins, something like:

class ThingFish::AuthFilter < ThingFish::Filter
    include ThingFish::AbstractClass
    
    virtual :authenticate_user
    
    def handle_request( request, response )
        # Put most of the real guts of the auth system here, 
        # and grab the user and any relevant group info from the
        # abstracted #authenticate_user when appropriate.
    end
end

class ThingFish::HtpasswdAuthFilter < ThingFish::AuthFilter; end
class ThingFish::LDAPAuthFilter < ThingFish::AuthFilter; end
class ThingFish::MetastoreAuthFilter < ThingFish::AuthFilter; end

Also, the filter should just do authentication, not authorization. Authorization can be done abstractly as long as the authentication systems populate the same fields in the request like authenticated_user, user_groups, etc. Doing it this way has several benefits:

• You can swap out auth systems transparently -- all per-object permissions should still work.
• It would allow a specialized plugin to combine several auth layers, allowing us to, for instance, allow external users to download stuff without them having to be in LDAP.
• Way easier to test, eliminate edge cases, information leaks, etc.

Authorization should be a handler, I think, since it will almost certainly need access to the metastore. That will also allow us to have separate auth systems for /«uuid», /admin, etc.