DefaultAclManager keeps redundant information about global service users

with SLING-10920 a separate set of all service users across different packages is kept, which heavily overlaps with the 'systemUserIds' set, which also intends to keep track of global service users. the id-set goes a further and in addition also records those service user ids that have been defined with the 'seed' or repo-init statements. however, for those it's not possible to determine their path (in contrast to content packages) and thus no "SystemUser" objects have been defined so far.
upon execution the the service-user-paths are used to determine if a given access control entry points to some user home.

this means however, that we will today reject access control entries defined in a content package if the corresponding service user has been defined with repo-init or the seed. i am not sure how common this is, but we might want to simplify the structure and merging the 2 redundant sets. maybe some sort of service-user-stub where the path is not defined and make sure those are excluded from the special path calculation?