Allow to distinguish between non-existent domain-objects and missing permisison for a domain-object

I would like to suggest an improvement to spring-security-acl that allows us to distinguish between non-existent domain-objects and missing permissions for a domain object easier.

Currently when using AclPermissionEvaluator we get an AccessDeniedException when either there is no Acl found for the oid/sid at all or if there is an Acl found but permission is granted to the sid for the desired oid.

Assuming that when using spring-security-acl you would add an Acl on object-creation to every domain-object of the same type, we can interpret a missing Acl for an oid as "the object does not exist".

Although using @PostAuthorize you would at least have the possibility to do a check if the desired domain object exists in your business logic, using @PreAuthorize in your code you cannot distinguish both cases (non-existent vs no access) in the calling method.

The Background for this is, that it is a common UseCase that you want to decide on the HTTP Status Code returned from a Controller in an ExceptionHandler based on the type of Exception you get.

My proposed change would be to rethrow the NotFoundException (or any other suitable exception indicating a "not found") in https://github.com/spring-projects/spring-security/blob/8dd2864dea3de5ea98637a1629debc89c29e76c0/acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java#L118

Additionally to be sure that there is really no ACL existing, there would also be the need to change https://github.com/spring-projects/spring-security/blob/8dd2864dea3de5ea98637a1629debc89c29e76c0/acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java#L103 to read the acl only based on the oid (without including the sids).

Start with the referenced lines in acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java, especially the ACL lookup and exception handling. Trace how lookup by oid and sid currently behaves, then determine how a missing ACL should be distinguished from denied permission. Done means callers can receive different outcomes for a nonexistent domain object and an existing object without permission.