add and use more pseudonym permissions

fixes CNVS-16477

The :update permission allows a user to update the pseudonym. Specific
portions of the pseudonym may be controlled by more specific permissions
(see below). To update a user's pseudonym requires :manage_user_logins
permissions on the pseudonym's account. A non-admin can only update
their password (see below) on their own pseudonym, which is separate
from this permission.

The :change_password permission allows a user to update a pseudonym's
password. An admin updating another user's pseudonym can only update the
non-managed password if the account allows admins to change passwords
(:admins_can_change_passwords setting). A user (admin or not) can always
update their own non-managed password. Managed passwords can never be
updated through Canvas.

The :manage_sis permission allows a user to update a pseudonym's SIS id
(sis_user_id attribute). It is simply inherited from the pseudonym's
account.

test-plan:

 * given
   - Sally who's an admin with the :manage_user_logins
     permission on one account (Account1) and a student on another
     account (Account2)
   - Bob who's a student on both accounts
   - Alice who's an admin on Account1 with greater permissions than
     Sally

 UNIQUE IDS:

   being able to update a unique ID entails being able to PUT to
   /users/:target_user/pseudonyms/:target_pseudonym?
     pseudonym[unique_id]=new_unique_id

   * Sally should:
     - be able to update her Account1 unique ID
     - be able to update Bob's Account1 unique ID
     - not be able to update her Account2 unique ID
     - not be able to update Bob's Account2 unique ID
     - not be able to update Alice's Account1 unique ID

 PASSWORDS:

   being able to update a password entails being able to PUT to
   /users/:target_user/pseudonyms/:target_pseudonym?
     pseudonym[password]=new_password&
     pseudonym[password_confirmation]=new_password

   * given both accounts allow admins changing passwords, Sally should:
     - be able to update her Account1 password
     - be able to update her Account2 password
     - be able to update Bob's Account1 password
     - not be able to update Bob's Account2 password
     - not be able to update Alice's Account1 password

   * given both accounts have managed passwords (pseudonyms have SIS ids
     set and accounts have non-password authentication), and still allow
     admins changing passwords, Sally should:
     - no longer be able to update her Account1 password
     - no longer be able to update her Account2 password
     - no longer be able to update Bob's Account1 password

   * given Account1 disallows admins changing passwords, Sally should:
     - still be able to update her Account1 password
     - no longer be able to update Bob's Account1 password

 SIS IDS:

   being able to update an SIS ID entails being able to PUT to
   /users/:target_user/pseudonyms/:target_pseudonym?
     pseudonym[sis_user_id]=new_sis_user_id

   * given Sally doesn't have the :manage_sis permission on Account1,
     Sally should:
     - not be able to update her Account1 SIS ID
     - not be able to update her Account2 SIS ID
     - not be able to update Bob's Account1 SIS ID
     - not be able to update Bob's Account2 SIS ID
     - not be able to update Alice's Account1 SIS ID

   * given Sally has the :manage_sis permission on Account1, Sally
     should:
     - be able to update her Account1 SIS ID
     - be able to update Bob's Account1 SIS ID
     - still not be able to update her Account2 SIS ID
     - still not be able to update Bob's Account2 SIS ID
     - still not be able to update Alice's Account1 SIS ID

Change-Id: I9b08ed67db8e2c664c057bb9259a8b18999b0863
Reviewed-on: https://gerrit.instructure.com/42772
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>