Per-entity CRUD filters and authorizers for UpdateBuilder

[andrus]

Similar to #501, let's implement a set of rules for CRUD operations (UpdateBuilder). This will require a read "filter" and create/update/delete "authorizers".

• A filter would exclude unauthorized objects from response
• Authorizers would fail the whole request with 403 Forbidden should at least one of the checks fail.

Usage Example

This is per-request API. Same rules can be applied per Agrest stack using similar AgEntityOverlay methods.

 Ag.service(config)
    .createOrUpdate(E2.class)

    // per-request filter
    .readableFilter(E2.class, e2 -> /* .. */)

    // per-request authorizers
    .createAuthorizer(E2.class, u -> /* .. */)
    .updateAuthorizer(E2.class, (o, u) -> /* .. */)
    .deleteAuthorizer(E2.class, o -> /* .. */)

    .syncAndSelect(updates);