Add ACL transform support to feeds

Named resources now are transformed as would be expected. Group
definitions took more work to define what was expected.

Group definitions aren't ACLs, so AclTransform turned into more of a
"Principal Transform", but its name is being kept. Since going through
the transform can cause duplicates, we now sort and remove duplicates of
the outgoing principals for each group (like we do for ACLs). However,
removing/merging duplicate group principal keys does not occur, because
there is no way to handle this properly.

Therefore, ACL transforms have the additional limitation that you must
not cause collisions of group names whose definitions are being sent in
feeds. There is no checking to warn the user if a collision occurs.
6 files changed