Specify the evaluation language more explicitly

* Remove `get` in favour of [binding key]. This means an indexed object
  must be let-bound, which I don't see as a problem. I really don't want
  to introduce evaluation of the call slot, it kills static analysis.

* Remove partial evaluation, and require base permissions to be
  explicitly declared (in the ConfigDB). We cannot defer evaluation to
  the consuming service as this would prevent us from implementing ACLs
  on ACLs.

* Start looking into static analysis of template definitions so we can
  track which sources of information apply to a given request from a
  consuming service, and which ACEs will need expanding.