Support group-wide administrator privileges.

If an admin user or group has permission to read/write/manage a target
user, the admin's permission extends to all other objects on which the
target user has permission.
Document group-level administrator semantics.
Add a system_group, and ensure it has can_manage permission on every
existing and future user.

This lets us give a user access to all users' data (on read-only or
read+write basis) without also giving them system level privileges
with the is_admin flag (which would also let them override business
logic like UUID assignment).
Add migration to create system group in existing installations.
Fix down-migration: delete the system_group and automatically
generated links, and rename the migration.
Merge branch '2498-group-admin'

closes #2498