Authorization for framework effective capabilities.

As noted by greggomann, we should add an authorization hook to the application of framework effective capabilities so that authorization modules can make fine-grained decisions about which effective capabilities they are willing to allow specific tasks to hold.