Per-document access control

(@janl: Rewriting the issue to reflect the work status)

### Todo:

- [x] isolate couch_doc.erl patch to permit new private-to-couchdb field `_access`, so we can maintain replication compatibility. This can land at any time, and we should at least do one 2.x release with this. If the rest of this doesn’t land for 3.0, this one patch should be in 3.0 for the same reason. (complexity: 1)

- [ ] rebase against master. the current WIP branch is about a year old, and while not a lot has changed in the parts, and the patch isn’t that large, some adjustments needs to be made (complexity: 3)

- [x] fix revs_diff endpoint (explanation TBD) (complexity: 1)

- [x] update replicator to write local docs with _access if source and/or target are access-enabled (complexity: 2)

- [ ] clean up [RFC](https://github.com/apache/couchdb-documentation/pull/424) to be more RFC-like (c.f. Garren’s comments there) (complexity: 1)

- [ ] write end-user docs and release notes (complexity: 1)

Old ticket content
@janl says:
>I don’t know what this will look like, but this is a pattern, and we need to support it better.
>
>One approach could be “virtual dbs” that are backed by a single database, but that’s usually at odds with views, so we could make this an XOR and disable views on these dbs. Since this usually powers client-heavy apps, querying usually happens there anyway.
>
>Another approach would be better / easier cross-db aggregation or querying. There are a few approaches, but nothing really slick.