Implement study admin role, separate from data submitter

[kcranston]

OICR distinguishes between a study admin (can read / write all study data, including the list of people who can submit data) and a data submitter (can submit data for a study). We only implement a POST request on /study that both creates the study and adds the users. Editing the users requires re-POSTING (can only be done by someone with edit permission as per paths.json). We need to separate the CRUD operations to allow a user to edit the list of study people without removing / adding the study.

[daisieh]

I think we can broaden this conceptually: Services should be able to assign actions and endpoints to any of the CRUD operations separately. In this case, the authz service itself should be able to decide if a user has Update access and what endpoint/action that corresponds to.

[daisieh]

needs to be addressed in defaults/paths.json as well as the ServiceRegistration schema.