Implement User permissions

[oharsta]

See https://github.com/OpenConext/OpenConext-access/wiki/Roles-&-Permissions for the actual implementation and https://confluence.ia.surf.nl/spaces/TIINN/pages/276206332/Vaststellen+rechtenmatrix+voor+toegang+tot+SURF+Access for background on this issue

If there are discrepancies, please update https://github.com/OpenConext/OpenConext-access/wiki/Roles-&-Permissions and an non-checked item to the checklist below.

• Client side
• Server side

[gelsenaar]

Scenario: Org Admin1 invites Org Admin2 to join
Issue1: When Org Admin2 clicks the link in the invitation mail, he is brought to the Homepage of Access (via eduID login). There he sees the 404 screen.

Issue 2: Then, click on Home and you have to select your organisation. That I find strange, because you are invited to a specific organisation.

Scenario: A user is member of an app
Issue 1: User can delete the Admin user (who is also Member of the app team). This should not be possible.
Issue 2: User can invite new users. This should not be possible.

Scenario: User is added to the app team by an Admin user
Issue 1: The user that was added does not receive a notification of this. Should he receive a notification?

Scenario: User with role Guest is added to an app of an organisation
Issue 1: The Guest-user can invite new users. Should this be possible?

...Not finished testing yet ....