Controller management logic

Add a Controller management layer into the new Controller api:
* contains the "desired node state" for acl, groups, bindings, scenes
* validates the state whenever a node comes online and do corrective measures if out of sync
* tries to optimize ACL entries
* offers convenient APIs to add acls, groups, bindings
* group rotation and other controller activities (e.g. also ota checking)