SI: Rule-based permissions service

This feature will enable permission checking in Storage Inventory at a SRC.  This in turn will allow users, with tokens from IAM, to write files and read proprietary files from Storage Inventory.

The primary benefit of baldur is that grants are decoupled from storage, so a single rule in baldur can grant access to an arbitrary number of files more or less instantaneously.

Also, this allows grants to be centralized and thus controlled in one place.  The service is designed so the having mirrors for high availability is trivial.

A service implementing the baldur API is deployed.  A user is given permissions (from the rules in baldur) to write files to a test namespace through membership of a test group in IAM.  The user, with a token obtained from IAM, will call the minoc API to write a file.  minoc will makes calls to baldur then gms to confirm the permission is granted and allow the user to proceed to write the file.

Code and deployment documentation will be checked into gitlab.  Unit tests and integration tests must accompany the code.