to the extent that the match operator ~ will actually accept vmod
function/method calls returning it.

Because VMODs also need an invalid ACL value to signal error, we stop
panicking for a NULL ACL and trigger a VCL failure instead.

The use case is not (yet) to generate dynamic ACLs, but rather to store
and recall global ACL symbols.

This implementation was particularly simple thanks to Dridis work
on #3555 and VCL_REGEX.