Issue title: SEC-1166: Provide strategy interface for AclImpl isGranted() method. 
 Issue body: [Luke Taylor](https://jira.spring.io/secure/ViewProfile.jspa?name=luke) (Migrated from [SEC-1166](https://jira.spring.io/browse/SEC-1166?redirect=false)) said:

This will allow more flexibility in the way the permission bitmasks are evaluated. The existing auditLogger should be moved to the default implementation, as this is the only place logging occurs in AclImpl.

 Comments: 
 Comment 0: [Luke Taylor](https://jira.spring.io/secure/ViewProfile.jspa?name=luke) said:

Done. See "source" tab for information.

 Comment 1: [Bojan Tomic](https://jira.spring.io/secure/ViewProfile.jspa?name=veggen) said:

Does this mean providing a bitwise comparing strategy is a safe thing to do?

 Comment 2: [Peter Rietzler](https://jira.spring.io/secure/ViewProfile.jspa?name=prietzler) said:

It would be nice if DefaultPermissionGrantingStrategy would contain a template method in order to decide if a permission is contained in the given mask - see 
https://gist.github.com/oliverfernandez/36846fcdc03696a7b829
which is a copy with a new method containsPermission. If DefaultPermissionGrantingStrategy would adopt this with a protected version of containsPermission it would be easier to add stuff like bit-wise permission checking etc.

 Comment 3: 

This issue supersedes #740
{'source': 'GithubIssues', 'repo_name_with_owner': 'spring-projects/spring-security', 'issue_id': 131773545, 'repo_stars': 7196.0}