ESciDoc User Group Handler

General Concept We need to enable the grouping of users. These groups are held in the System. It is possible to grant one or more roles to a group. Groups can consist of: -All users belonging to one or more organizational units and their child organizational units. -A list of users defined by their userId. -A list of groups defined by their groupId. -mixed lists of orgUnitIds, userIds and groupIds. Core System needs a GroupHandler that enables creating, updating, deletion and retrieval of groups. It must be possible to grant roles to groups. It also must be possible to restrict a granted role to a scope (eg a particular item). When a user calls a method in the framework, not only the policies of the granted roles of the user are evaluated but also the policies of all granted roles of all groups the user belongs to.