#16 permissions to become immutable

[Ben Walding]

to finalise the basic contract that an ACL is
immutable, we need to add permissions to the acl
constructor and then make the permissions object immutable

This should just be a matter of altering the permission
modification calls to return a new permission object on
each operation ala BigDecimal.add style methods.