Introduce more roles for Manage permissions

[thijskh]

Manage permissions are now relatively flat:

• For the GUI, all users that have authenticated have admin privileges (can do everything)
• For the API, there's a number of permissions per account (READ, WRITE, ADMIN, PUSH)

Because of the limited possibilities quite some use cases have too wide permissions:

• SP dashboard has admin permissions so can write to anything, including IdPs
• Anyone with a support role (and also SP dashboard) can create attribute manipulations. Attribute manipulations are arguably one of the most "dangerous" platform features when used unauthorized.

Proposal:

• Create new permission specifically to be able to change AM's, because it's so different from the other functionality. Only users with this permission (team membership) will be able to do this. Only the users that actually need this will get this permission. So not first line support or (an adversary that has compromised) SP Dashboard.
• Create more fine grained permission for use by SP dashboard, that its api account can only change SP/RP/RS and not IdP (which is much more dangerous)

[oharsta]

The available scopes are described here: https://github.com/OpenConext/OpenConext-deploy/blob/master/roles/manage-server/templates/manage-api-users.yml.j2