core: requiring permissions to manage tags, bookmarks and notifications

This patch adds three new action groups, and three new roles, used to
manage tags, bookmarks and notifications.
Relevant commands were once allowed for every administrator, so the
upgrade process adds these action groups to every admin role that
includes more than the login permissions action group (to solve the
ReadOnlyAdmin use-case).

So, after upgrade all the user roles will be left unchanged.
All the admin roles will now contain the new action groups, except for
admin roles that only contain the login action group.

Change-Id: I477bca5703f59c67914e6395118e29d53fa7d007
Signed-off-by: Oved Ourfali <oourfali@redhat.com>