Slightly improve safety by making the zero value invalid.

Add new methods to the Keycloak client to:

* look up user group permissions with support for subgroups.
* look up ancestor groups of a given group.

In addition, refactor the keycloak client to support paging through
results from the Keycloak API.

In support of the headline change, also add a "cache map" type which
implements an in-memory cache map with individual value lifetimes.

Refactor permission engine to use the new keycloak client functionality
which adds support for subgroups, and refactor session logic to use the
new permission engine.