Separate concerns for node access "acquire" and "write" actions

Thinking "dependency injection" models. For its long history, node_access_acquire_grants() has called node_access_write_grants(). That doesn't seem proper. The act of "acquiring" is not the same as the act of "writing".

Separating those functions out and issuing a proper return of $grants would also give us more API flexibility.

Done properly, it might also allow for swappable storage to satisfy the noSQL folks, as discussed in #1819726: Move node access code into a pluggable class