DDSSEC_ — Use of 'partition' in access control is unclear

The mechanism of testing the 'partition' for match is not fully described. A “rule” specifies a set of partition names, and an “entity” provides a set of partition names.

What is sufficient to determine that a match exists: exact set match, set intersection, strict subset match?

This impacts the behavior of these methods on AccessControl:
check_create_datareader()
check_create_datawriter()
check_remote_datareader()
check_remote_datawriter()

Modify Permissions Document Schema to clarify rules for multiple partitions and topics

Modify the XSD for the Permissions document so that each "grant" (publish/subscribe) contains three sections: <topics>, <partitions>, and <data_tags>.

The <data_tags> remains as before.
The <topics> section contains a list of topic expressions, each enclosed by the <topic> tag.
The <partitions> section contains a list of partition expressions, each enclosed by the <partition> tag.

For the grant to match there shall be a match of the topics, partitions, and data-tags criteria. This is interpreted as an AND of each of the criteria. For a specific criteria to match (e.g. <topics>) it is enough that one of the topic expressions listed matches (i.e. an OR of the expressions with the <topics> section).

This change applies to the Permissions XSD as well as the Example Permissions files which appear both inside the specification and as separate machine readable documents.