Prevent editing of rota entries for past showings
Add read-only (and write to rota) 'volunteer' user

User doesn't have the "toolkit.write" permission, but does have the
"diary.change_rotaentry" permission.
Allow rota editing with only change_rotaentry perm

Change it from requiring the all-powerful 'toolkit.write' permission to
only needing the 'diary.change_rotaentry' permission.