Fix backend permissions to allow repository managers to change user groups

* Removed permissions on the "list users" endpoint (not needed)

  * Change the "update user" endpoint to work out whether it's being asked to
    change a user or just their group memberships.  Require different
    permissions depending on which it is (manage_users for the former;
    manage_repository for the latter)

  * Change the frontend templates to require manage_repository, not
    manage_users when displaying the group listing.