When overriding Initial ACLs on / check for the permissions

Since the initial ACLs on `/` are volatile for `Anonymous`, once those are overridden (an append or a replace happens) they are not available anymore. This could lead to a situation where no one has access to do anything in the system if the newly set permissions are not correct.

We should check on the ACLs state machine that when performing a `replace` or `addition` and the previous state is `Initial`, we will reject if the newly passed permissions do not contain at least `acls/read` and `acls/write`

Start with the ACL state machine and trace the replace and addition transitions from the Initial state. Verify how permissions are represented and validated, then add coverage showing that transitions lacking both acls/read and acls/write are rejected while valid permissions are accepted.

Written by the indexing model from the issue text.