badge permissions

In the past only admins could create, edit and delete badges. This introduces some new permissions to make that a bit more flexible.

I chose to stick to the checks that already existed in `lib/auth/badge.py`. I added permissions for each of them and enforced them everywhere.