Rework Tobira permission roles: remove "Tobira moderator", add "Tobira admin", add granular roles

[LukasKalbertodt]

This PR:

• Adds ROLE_TOBIRA_GLOBAL_PAGE_ADMIN and ROLE_TOBIRA_GLOBAL_PAGE_MODERATOR. With said roles, the user is page admin/moderator on all non-user pages, without having to be mentioned in the page ACL.
• Adds ROLE_TOBIRA_CAN_FIND_UNLISTED. Users with that role can find unlisted events/series when editing page content.
• Remove ROLE_TOBIRA_MODERATOR. The term "Tobira moderator" is no more. It is unclear what permissions that role should grant. And the last few releases crippled "Tobira moderators", taking some permissions away.
• Add ROLE_TOBIRA_ADMIN. Users with that role have all Tobira-related permissions. But unlike ROLE_ADMIN, they do not automatically have access to all content.

Fixes #1133

This PR also adds docs about this topic. Rendered version:

This PR should be reviewed commit by commit.

[KatrinIhler]

Like I said, I'm not (yet) an expert on Tobira permissions, but it sounds reasonable.