gh-323: roles

Implement granted privilege cache in struct user.

Reload user privileges from system spaces and
rebuild the cache whenever a grant or revoke occurs..

Implement revoking privileges from a role.
Basic tests pass.

Do not rebuild the privilege cache of objects
for which it can't have changed with a grant
or revoke.

Optimize rebuild_effective_grants().

Make role.test idempotent.

Make grant and revoke robust to malformed arguments.
Fix bugs in schema.lua, related to incorrect arguments
for grant/revoke.