Enforce format of permissions value

[bradleybeddoes]

Permission values should look like this:

# "word" in the url-safe base64 alphabet, or single '*'
SEGMENT = /([\w-]+|\*)/
private_constant :SEGMENT
validates :value, presence: true,
                    format: { with: /\A(#{SEGMENT}:)*#{SEGMENT}\z/ }

The specs which Gumboot shares with client apps should enforce this so that apps don't need to do it themselves i.e https://github.com/ausaccessfed/spin/pull/6