Add new privileges for reading and writing prinicpals.

[evert]

This is a work in progress.

Todo:

• [x] Clean up remaining items from principal/service.ts
• [x] Update changelog to note that member-collection (which was deprecated much earlier) is now permanently removed
• [x] Remove member-collection links from groups
• [x] Stricter typing for permission.check
• [x] Add privilege descriptions to privilege types database