implement advanced permission settings

Now we have detailed control over which users are allowed
to activate the connection. However, NM behaves inconsistently
(using 0.8.9997): it treats all connections with more than one
permission as system connections, asking for the root password
when creating or changing them (that's definitely not our own
KAuth code, I checked). However, when removing the currently
logged-in user from the permission list, leaving only other
users there, NM complains that the currently logged-in user
isn't authorized to do that, without asking for the root password
(that's why removing the current user is disabled in the widget).

By the way, since NM is now handling polkit, I think we should
remove our own implementation in one of the next code cleanups