Add permissions for how roles can interact

[chris-steele]

Currently if a limited role is given access to user management it can delete accounts with super user rights. We need a way to control how a role can manage other roles.

[chris-steele]

@taylortom is this something you can look into? Hopefully this module is the most appropriate place, but feel free to move the issue if not.

[chris-steele]

My first thought on this: can we keep it simple and use the extends property of roles to achieve this? A role that has the scope write:users can only mutate users of subordinate roles (i.e. those that it extends). For example, contentcreator extends authuser so the former can mutate the latter.

The above would of course limit the flexibility of roles and require a linear chain of command so to speak, so a more flexible approach could be for each role to have a list of role IDs for which it can mutate. For example, superuser would have the list [contentcreator, authuser].

[taylortom]

My thoughts on this:

1. Super users should be treated as a special case, and should not be modifiable by other user types
2. As long as a role has the correct scope, it should be possible to modify any other user type. For transparency sake, I don't think we should introduce a hierarchy to restrict which roles can modify which other roles.