permission plugin: Generate ACIs in the plugin
    
    Construct the ACI string from permission entry directly
    in the permission plugin.
    
    This is the next step in moving away from ipalib.aci.
    
    Reviewed-By: Martin Kosek <mkosek@redhat.com>