Add "manage users" permission

The first commit transposes the permission spec, so it's easier to see the changes if the two commits are viewed separately.

There is a signonotron PR which adds the actual permission (https://github.com/alphagov/signonotron2/pull/69).