API/DAO - Improve permissioning sql clauses: support field names and OR

Before: selectWhereClause was limited to returning arrays of clauses which would be
joined with AND. They could not reference any other fields on the entity.

After: selectWhereClause can return sub-arrays which are joined with OR,
and can reference any field on the entity using {curly_brace} syntax.

Stricter type checking emits noisy deprecations if arrays are expected and strings are given.