Add /permissions cleanup command which for now only deletes expired group memberships.