Add new permission 'user.badge'

This adds the permission `user.badge` and assigns it to moderators by default. This was before tied to the permission to change user groups.

You may consider this part of #367.