Go through permission checks and rework to generated detailed information.

[markan]

This builds on #12239

We currently don't give very detailed information when acl checks fail. We should fix this by going through our code and wherever possible capturing the full information available at the point of error construction. This intended to be relatively low impact work and should not include cases where the enforcement decision is not near the construction of the error.

Note: For review purposes this work will probably be broken down into smaller PRs on a subsystem basis.