Allow admin groups to have multiple api scopes. Other cleanup.

As part of this, things have been renamed to hopefully make more sense.
AdminScopes/scopes are now API Scopes. Group "access" is now
"permissions". Permissions are now represented as a model and API,
rather than a hard-coded list we had to keep in sync between the
frontend and backend.