It makes more sense to define it where interface is defined,
rather than on the implementation side.

... about transfer list changes. Assume that only those who fetched
the current list of transfers, are interested in receiving updates.

Later, those requesting the full list will go through access check,
which will guarantee that those who are not allowed to get the list
of tranfers, won't receive signals too.

By default, only privileged and sailfish-mms groups (effective or primary)
are allowed to call most D-Bus methods.

D-Bus access rules can be configured by adding [DBus] section to
/etc/mms-engine.conf config file:

[DBus]
MmsEngineAccess=...
TransferAccess=...
TransferListAccess=...

The default rules are:

MmsEngineAccess:

  (!group(privileged))&(!group(sailfish-mms))&(cancel()|receiveMessage()|
  sendReadReport()|sendMessage()|push()|pushNotify()|setLogLevel()|
  setLogType()|migrateSettings())=deny

TransferAccess:

  (!group(privileged))&(!group(sailfish-mms))&Get()=deny

TransferListAccess:

  (!group(privileged))&(!group(sailfish-mms))&(GetAll()|EnableUpdates()|
  DisableUpdates()|GetSendProgress()|GetReceiveProgress())=deny

D-Bus access control

See merge request mer-core/mms-engine!22