New group permission ```group.can_manage```

[Elblinator]

There should be a new group permission group.can_manage
This permission should make the following actions possible group.create, groups.update or changing the permissions of any group.
If a user (who has user.can_manage but NOT groups.can_mannage) cannot import any participants into a groups with group.can_manage permission. The import shouulld throw an Error.

You should not need this permission to set a group. But trying to add a group with this permisison without having it yourself should be blocked.

[luisa-beerboom]

This is going to require a migration either way, so why not do it cleaner?

How about instead creating a group.can_manage permission and requiring that to change group permissions. We can remove the group-editing functionality from the user permissions entirely that way.

Additionally we could also create group.can_manage_settings and group.can_mange_memberships sub-permissions to also make setting groups for users restrictable in that manner, independently from editing group perms.

[Elblinator]

We decided for a group.can_manage permission.
The group-editing funtionality will be completely removed from the user.can_manage .
Group creating and group updating will be decided by the new permission
If you can add/remove a group will be decided by user.can_update

[luisa-beerboom]

...and if you have user.can_update or user.can_manage you can only add groups that don't have group.can_manage, unless you have `group.can_manage yourself.