Add scopes for GrSciColl users

[marcos-lg]

No description provided.

[ManonGros]

We would have the two following roles:

GRSCICOLL_ADMIN:

• Can edit everything
• Get a warning when editing IH entry in the UI

GRSCICOLL_EDITOR:

• Cannot edit IH_IRN identifier
• Get a warning when editing IH entry in the UI
• Cannot edit machineTag
• Can create and edit all staff
• For everything else, editor's right will depend on a scope:
  • If given institution permission:
    • can edit existing institution
    • can create and edit related collections
    • can add staff to institution and related collections
  • If given collection permission:
    • can edit existing collection
    • can add staff to collection

[marcos-lg]

When implementing this I assumed:

• Editing also includes deleting
• Editors are not allowed to create institutions
• Editors can't create collections that are not linked to any institution.
• Editors can change the institution key of a collection if they have rights in the updated institution and they still have rights in the current collection or institution.

[marcos-lg]

Deployed in PROD

[MortenHofft]

@marcos-lg Would it make sense to say that registry admins can edit anything? I mean, a registry admin can just edit their own roles anyway.

[marcos-lg]

@MortenHofft no, registry admins can't edit anything in GRSciColl - GRSciColl uses only GRSciColl roles. I separated the roles some time ago to make GRSciColl more independent and have more control over permissions.

[MortenHofft]

To avoid issues like gbif/registry-console#357 there is now this issue #293