Store client-side role-permissions in one place.

[IanMayo]

Soul is now protecting tables using permissions for roles.

A couple of issues have demonstrated that this is working effectively.

But, while that is valid, we use roles to decide which actions to offer to the user, either by using the role-string or the id of the role.

This logic is spread across VAL. It would be easier to audit/verify if these were in one place.

We have a rolesThatCanEditPassword const in UserShow. It contains an array of role names that can do the operation described in the constant name.

We should follow this practice across all of VAL, centralising them in a file called clientPermissions. Note: we should use const values for role-value, not strings.