[ephs] split out low level client, add r/w permissions

[ephs] split out low level client, add r/w permissions

ephsll contains the etcd interaction parts of ephs, and includes an `ephs.Client` implementation which can replace the default client for a process that has unrestricted access to the etcd prefix.

ACLs for ephs now also gain mode bits for read and write access separately, allowing subtrees or individual paths to be world-readable but writable only by the owner.