Added support for the %GROUP% wildcard.

%GROUP% is the same as %USER% except it's done on each group a user is
in.
%USER% and %GROUP% cannot be mixed on an ACL line.