Simple permission mapper is not simple due to lack of default fallback

Certain common constructs are unnecessarily complicated or effectively impossible for everyday users to configure in the management model (such as "if these principals match, use these permissions, else use these permissions") due to the lack of backend support for a default case in the SimplePermissionMapper.

Add a way to introduce a Mapping which matches all principals. The most general way to do this simply is to change the principal set into a principal predicate.