Add a member_list permission to allow or deny viewing of the full member list

This can be useful in situations where users should be able to see their own payment status, but for data security reasons they should not be able to see who else is a member. With the existing permissions, this case is not possible to model. With the new member_list permission, users who have this permission have acccess to all member information and the full member list. If member_list is not set, the users can only see their own information (and only their own entry in the member list).

Both members and directors are given this permission in the default configuration, so no behaviour is changed from the existing configuration.