The deciding ACE should be able to pass out one argument

When authorization is denied, sometimes the steps to be made depend on _why_ it was denied.

As a consequence, the deciding Access Control Entry must have the ability to pass an argument which PyACL implementations could use to decide the steps they'll make in such situations.

This should be implemented as an optional text attribute of the ACE and passed around as is (i.e., it shouldn't be validated or transformed).

It may also be useful when authorization is granted, so if it's defined, it should be passed around as well.