Implement permission provisioning and watchers

Remove rule reset from roles cli command
Add generic "provision" command for each binary and (re)set perm. rules
Permission rules are now separated and part of AccessControl service

Facility for watchers was added.

cmd/system/main.go

@@ -46,6 +46,11 @@ func main() {
 	switch command {
 	case "help":
 		flag.PrintDefaults()
+	case "provision":
+		if err := system.Provision(ctx); err != nil {
+			println("Failed to provision system: ", err.Error())
+			os.Exit(1)
+		}
 	default:
 		// Checks subscription, will os.Exit(1) if there is an error
 		ctx = subscription.Monitor(ctx)