Separate out the updating of permissions in `ConferenceUpdateProcess`
 - make sure they are authorized by `AuthorizationService`
 - process also sets the timestamp and given_by_id