nest permissions in module

Fixes https://www.openproject.org/work_packages/7679

Note that this will not influence existing installations of the documents plugin. A role having granted such a permission before will still have it afterwards.