Split <Permission>Handle and <Permission>Proof types in shared value package

[HerbertJordan]

Right now, types like "ReadHandle" are used for two different purposes:

• to represent the allocation of an access right and to release this allocation when no longer needed
• to proof to others that a certain access right has been acquired

The later case does not require to grant others the right to release this allocation. However, currently, this can not be separated.

It would be desirable to split those two roles for a more fine grained propagation of responsibilities and abilities.