With current ACL parsing, if you have a ':' in a group name (as
occurs with FreeIPA permissions, which matter for upcoming external
principal support) you are stuffed. This commit fixes that.
It is really a band aid - the existing parsing code is poor and
should be replaced with a nice combinatorial parser... but who has
the time for that right now? ¯\_(ツ)_/¯
Note that if there is a ':' in any of the ACL descriptions/comments
(the final field) this change breaks it. We don't have any
occurrences of that in our codebase.
Thanks,
Fraser