Add health check for ACLs

[awead]

Add a health check operation for ACLs. This can be run by OKComputer as part of its usual check process. The operation would check for:

• "incomplete" ACLs such as edit access that does not include read and discovery
• orphaned ACLs pointing to resources or agents that don't exist
• ACLs with agents that are no longer active at Penn State such as users who no longer have credentials or groups that no longer exist

[awead]

@rschenk Is this the kind of thing you were thinking about in #299?