lua/api: fix client update_permissions()

* the type checks were wrong, it was requiring the key to be string
  and the value integer
* add the ability to use "any" or "all" for a key, saving us the trouble
  of passing -1 from lua (int64) into a uint32 (ugh!)
* use a GArray instead of manual malloc/realloc
* allocate the array as late as possible, to minimize the risk of leaking
  its memory if we hit luaL_error()