authorization for "Adhoc" jobs needs explicit support in aclpolicy

aclpolicy should have explicit way to authorize "adhoc" commands.

Currently:

• If you try to run an adhoc job, it actually creates a transient job named "Temporary_Job" and with group "adhoc" (these are just placeholder non-null property values for the transient instance), so in order to authorize a user/group to run adhoc commands you need to set aclpolicy to allow a job with that name/group, but this is not very clean.
• If you view an Execution page, the option re-run the execution is only shown when authorization allows a job named "adhoc" and with a group named "adhoc" -- this is also not very clean and is inconsistent with the previous item.

suggest that we add something like: <job adhoc="true/false"> to the aclpolicy