* Test that `str.format` checks the security for attributes that are accessed.

Part of PloneHotfix20170117.

This needs https://github.com/zopefoundation/AccessControl/pull/23
This was merged, but not released yet, so we add AccessControl to auto-checkout for now.

* AccessControl has a release, no need for auto-checkout anymore.