Add new privileges for reading and writing prinicpals.

[evert]

This is a work in progress.

Todo:

• Clean up remaining items from principal/service.ts
• Update changelog to note that member-collection (which was deprecated much earlier) is now permanently removed
• Remove member-collection links from groups
• Stricter typing for permission.check
• Add privilege descriptions to privilege types database