More restrictive service user rights

Currently the (single) service user is used for almost all operations and grants full access to the repository.

```
set principal ACL for actool-service
    allow jcr:all on /
    allow jcr:all on :repository 
end
```

The permissions should be limited to what is actually necessary.
