Beginnings of acl (POSIX.1e draft 17) verification support

Beginnings of acl (POSIX.1e draft 17) verification support
- if built with --with-acl, check that files and directories don't have
  any extra acl's set
- for now, any acl beyond the regular unix permission set is reported as
  file mode difference as the acl's cannot have been set by rpm itself
- patch from Andreas Gruenbacher, modified to use libacl instead of raw
  xattrs for portability, BUT atm this uses non-portable acl_equiv_mode()
  Linux libacl extension, the posix draft doesn't seem to have much in
  the way of comparing entries :-/