Create more granular ACL capabilities.

This commit splits ACL policies into more fine-grained capabilities.
This both drastically simplifies the checking code and makes it possible
to support needed workflows that are not possible with the previous
method. It is backwards compatible; policies containing a "policy"
string are simply converted to a set of capabilities matching previous
behavior.

Fixes #724 (and others).

logical/request.go

@@ -121,8 +121,9 @@ type Operation string
 
 const (
 	// The operations below are called per path
-	ReadOperation   Operation = "read"
-	UpdateOperation            = "write"
+	CreateOperation Operation = "create"
+	ReadOperation             = "read"
+	UpdateOperation           = "update"
 	DeleteOperation           = "delete"
 	ListOperation             = "list"
 	HelpOperation             = "help"
@@ -133,6 +134,10 @@ const (
 	RollbackOperation           = "rollback"
 )
 
+func (o Operation) String() string {
+	return string(o)
+}
+
 var (
 	// ErrUnsupportedOperation is returned if the operation is not supported
 	// by the logical backend.