Adding modify-ldap-group to permissions

part of RT #6134 

"#6134: Replacement for formey ldap operations in eqiad"

this also appears on the RT triage duty page:

https://wikitech.wikimedia.org/wiki/RT_Triage_Duty

Change-Id: Ie4ff3f64d860791e79ef45397a41e34271c2b7b4