Create AclPermissionEvaluator to work with user groups

New Evaluator should:

1. Get all the groups user is in
2. Decide whether any of these groups have granted=false for this permission on this branch (branch is taken from Post). If yes, then false should be returned.
3. Then decide whether there are groups that have granting=true for this permission on this branch. If true, then return true. If no, then it's false.

Note, that for some permission we will need more sophisticated schema. E.g. for editing own posts we need to check whether this post is of this user, so a place for extension should be left for the Evaluator.