Add a 'grant_project_role' meta-role.

This should allow people to delegate 'grant' permissions without necessarily delegating the 'delegate' permission itself.