Core/RBAC: Move ban commands to RBAC (using individual permissions)