Add user management scope

This splits the user and groups API into those who have just 'read' access
and those who have 'manage' access.

src/accesscontrol.js

@@ -9,7 +9,8 @@ exports = module.exports = {
     SCOPE_MAIL: 'mail',
     SCOPE_PROFILE: 'profile',
     SCOPE_SETTINGS: 'settings',
-    SCOPE_USERS: 'users',
+    SCOPE_USERS_READ: 'users:read',
+    SCOPE_USERS_MANAGE: 'users:manage',
     SCOPE_APPSTORE: 'appstore',
     VALID_SCOPES: [ 'apps', 'appstore', 'clients', 'cloudron', 'domains', 'mail', 'profile', 'settings', 'users' ],
 
@@ -33,7 +34,7 @@ const ROLE_DEFINITIONS = {
         scopes: exports.VALID_SCOPES
     },
     'manage_apps': {
-        scopes: [ 'apps', 'domains:read', 'users' ]
+        scopes: [ 'apps', 'domains:read', 'users:read' ]
     },
     'manage_users': {
         scopes: [ 'users' ]