Quantitative Access Control Policy Analysis and Repair Using Model Counting