it gets unparsed.

Disclose permission intended to be used for "disclose on error"
(as in our present "none"), none being "don't disclose on error".

Manage permission is intended to be used to allow DSA IT management
(e.g., changing entryCSNs, structuralObjectClass, etc.).

move ACIs under a dynamic infrastructure that allows run-time loadable custom access control logic (needs work)

partially revert previous commit (the "creator" special DN pattern is redundant as "dnattr" is more expressive

frontend stuff moved into a database structure, essentially to allow overlays to be processed before database selection; passes all tests (ITS#3080)

cleanup

use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks