Restrict ACL association to the token accesses

The only way for someone to give access to another one, it's to have the 'auth.policy.#' access, wich will allow to update it's own policy or associate more access then allowed.

To avoid this scenario, wazo-auth should restrict accesses to the token used to create these accesses
It implies to cascade access from master-->admin-->user

ex:

• master: #

• admin: [confd.#, calld.#, phoned.# ....]

• user: [<specific access>, ...]

Todo

• handle negative access too

• compare pattern against pattern (which are not currently supported)

• migrate database to remove too permissive accesses

side note: the mechanic would be useful to create scoped refresh token too