Allow users in the access group to have read permission to the access group

When assign a user to the access group, we only grant the user the access to all datasets within the access group.

However, the user don't even have "read" permission to the access group record.

We should auto grant user the access to the access group record itself so he can view the info such as: access group purpose etc.

Changes required for creating access group API:
- We should create two extra permissions (non-manageable by users):
- a new "object/record/read" permission with Pre-Authorised Constraint
  - Add the permission id to access group's access-control aspect's preAuthorisedPermissionIds field.
- a new "object/accessGroup/read" permission with no constraint
  - this permission currently only used by UI as a short-cut to determine which user has access to access group UI.
- Add the two permissions to auto-created access group controlled role
Change required for deleting access group API:
- should make sure all permissions (including the permissions that are introduced by this ticket)

related to #3269

magda-io / magda