Customizable user roles

[matthew-white]

We know that there is interest in user roles beyond the ones we currently offer. We're tracking specific ideas for additional roles at #736. One option is that we simply add new fixed user roles, but another idea is that we add the ability for users to create their own roles. For each role, users would specify a name and a list of verbs that the role should confer.

Implied verbs

One piece of complexity in this area is that currently, some verbs imply other verbs:

• form.list implies open_form.list: if you can form.list, you can do everything that open_form.list grants. Similarly, form.read implies open_form.read. See Enumerator should be able to access only open Form central-backend#968
• The ability to update generally provides the ability to read. Authz reification of species and verbs, and verb implication central-backend#1205 (comment)

We would want to make these verb implications clear in Frontend. One approach that we've discussed to make verb implications more explicit is getodk/central-backend#1205. That PR adds a database table for verbs, as well as a table for verb implications. If such a table existed, then one idea is that Backend could return a list of verb implications to Frontend.