Make ResourceID actually opaque

This is a YAGNI-class problem: the ResourceID has a complex structure that unifies representation, classification, and opaque database ID. This is unnecessary and introduces a weird translation layer between these IDs and LDAP DNs. Furthermore, the path-like structure isn't really used, as we have parent_ids for hierarchy.

Instead, we should separate this into a Type, and a completely opaque database ID (which is never shown to the user), that can simply be the DN for the LDAP backend.