Add built-in, declarative auth system

Many authorization systems use the same approach:

- atomic actions; used by programs
- groups of actions; used by users to assign auth to users (i.e.; a manager can do a series of atomic actions)

This system could likely just come out-of-the-box with this so that you can just set it all up declaratively.

Of course, users could use the auth hook (#231) to implement their own if this doesn't work for whatever reason.

Start by reading the related auth hook issue (#231) and compare its proposed extension point with this request. Define the scope for atomic actions, groups, and declarative setup; the work is done only when the built-in system's behavior and integration boundaries are agreed.

Written by the indexing model from the issue text.