productionise secman a bit more (finish off ImpersonsateUserAdvisor)

DONE: use abstract superclasses, single layout

FIXED: don't allow user to see their permissions.

FIXED: veto viewing only disables (eg ApplicationUser#addRole or #lock actions for a regular user).

FIXED:

• accidentally created two roles with the same identifier.  This resulted in no fixtures being seeded.  My guess is there was an unlogged SQL exception.

public class RoleAndPerms__UserRw extends AbstractRoleAndPermissionsFixtureScript {

  public RoleAndPerms__UserRw() {
    super("user-rw", 
          "Read-write access to entire application");   
  }
  // ... 
} 

and (by mistake)...

public class RoleAndPerms__UserRo extends AbstractRoleAndPermissionsFixtureScript {

  public RoleAndPerms__UserRo() {
    super("user-rw",                                    <<<<< my mistake was here
          "Read-only access to entire application");   
  }
  // ...
}

DONE - update the @Configuration's, make sure they declare the correct services

DONE (enough) - update the docs (pre- and post- hooks etc).

specifically:

• DONE - clean-up @Configuration imports and service definitions (so there is less config needed for framework user)
• DONE - clean-up layouts.
  • https://github.com/apache/isis/pull/490  (Martin Hesse's change to dialog modal)  ... already merged to master
  • implement as ".fallback" layouts.
• DONE - write missing documentation on how to configure