Make CheckUser its own role

Split checkuser out from accountinfo.

Change-Id: Ie4e7f9d2c3043d333ee784aa25ac62f02049e9c3