use "expand" instead of "regex" for group ACLs that allow substring expansion, preserving backwards compatibility; add sanity checks

Recognise tree delete control - needs backend support

bdb_idl_cache_put replaces existing entries instead of ignoring them