add more restrictive sudo access to non-roots

creates a new 'mediawiki-ops' group, with 'arcane' as a member. More restrictive and controllable rights.