Detect changes in permission schemes and apply those changes to DB object

[shantstepanian]

Currently, the permission scheme is only applied to objects when they are created. If a scheme is modified, it won't affect existing objects

It would be nice to detect changes in the scheme and to apply them on all existing objects

In addition, a "sync grants" functionality would be useful to go w/ this

[gs-husam]

Should the permission schemes act as a declarative end-state, where an obevo deployment will always "upsert" privileges to match those in the permission scheme? E.g. going through all the objects, and making sure it has exactly what is declared in the permission schemes, nothing else, on every deployment? (or something to that effect)