Support extended authentication states to ACL results

Support extended authentication states to ACL results

Support sub-states of authentication to be sent as results from ACLs.
This allows future work to resolve issues around cases such as expired
but known credentials being used in fast category access controls.

The new authentication states are:
  ACCESS_AUTH_OK
    - equivalent to ACCESS_ALLOWED

  ACCESS_AUTH_REQUIRED
    - Missing Credentials. Used to be ACCESS_REQ_PROXY_AUTH

  ACCESS_AUTH_EXPIRED_OK
    - Expired now. Were Okay.

  ACCESS_AUTH_EXPIRED_BAD
    - Expired now. Were Failed.

Also converts cases of ACCESS_REQ_PROXY_AUTH to the new name.

As yet no attempt is made to alter auth or access control logics to use
the new states.