[bug 865705] Add permission to change needs_change* fields.

This pretty much works the same as the `can_archive` permission. Adds a test to verify it and a migration to add the permission.

r?