NACM: initial support, multiple admin users

[troglobit]

In cd52a42 and f5866ee3 we hard-coded default groups and a user mapping of 'admin' to the group of administrators allowed 100% access to the system.

For the next step we need to support users changing the NACM configuration, at least to the extent of adding regular users with one of the three roles: administrator (UNIX group wheel), guest, and operator. E.g., adding the user 'foo' as administrator should add them to the wheel group so they can manage the system from both NETCONF and the CLI.

As a twist, a rule with the following properties (admin-acl) should be the only rule that shows the shell node augment in ietf-system:

     "module-name": "*",
     "access-operations": "*",
     "action": "permit",

[troglobit]

Simplest way forward, check if user is in any¹ group that is in a rule that has:

"module-name": "*",
"access-operations": "*",
"action": "permit",

If user does not match that, we force shell 'clish'.

Footnotes

1. The same user can be a member of multiple groups. See https://www.rfc-editor.org/rfc/rfc8341#section-3.3.2 ↩