Fix inversion of exclusion permissions and model validation

[ronenh]

This includes two bug fixes:

1. Model validation wasn't checking for nil permission terms resulting in a panic instead of an error.
2. During the inversion of exclusion permissions it is possible for the inverted relation to only have the 'include' term without the second 'exclude' term on certain types if objects of that type cannot have the excluded permission/relation to the object being inverted. In such cases the exclusion permission on those types becomes a single-term union.

For example, in this model fragment:

doc:
  relations:
    owner: user
    viewer: user | group#member
  permissions:
    can_act: viewer - owner

Only users can have the owner relation to a doc but either users or groups can have the viewer relation.
In the inverted model we expect to see:

user:
    relations:
        doc^owner: doc
        doc^viewer: doc
        group^member: group
    permissions:
        $doc^viewer: doc^viewer | $group^member->$doc^viewer#member
        $group^member: group^member | $group^member->$group^member#member

        # the inverted permission remain an exclusion permission
        doc^can_act: $doc^viewer - doc^owner

group:
    relations:
        doc^viewer#member: doc
        group^member#member: group
    permissions:
        $doc^viewer#member: doc^viewer#member | $group^member#member->$doc^viewer#member
        $group^member#member: group^member#member | $group^member#member->$group^member#member

        # the inverted permission becomes a union
        doc^can_act#member: $doc^viewer#member

[coveralls]

Pull Request Test Coverage Report for Build 9922251632

Details

• 13 of 19 (68.42%) changed or added relevant lines in 3 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage increased (+0.03%) to 60.894%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
model/types.go	1	3	33.33%
model/validate.go	1	5	20.0%

Totals
Change from base Build 9911233963:	0.03%
Covered Lines:	2806
Relevant Lines:	4608

---

💛 - Coveralls