Problem: Package deletion requires Storage Service login

[sromkey]

Please describe the problem you'd like to be solved
To complete the deletion of a package, a Storage Service user needs to approve a deletion request that came from the dashboard or an API request. While this isn't problematic in some environments, in others, Storage Service accounts are limited due to the technical nature of the application.

Describe the solution you'd like to see implemented
We'd like to have a Storage Service user who only has access to the Packages tab of the Storage Service interface. This user should be able to do all functionality currently available on the Packages tab, but be restricted from all other tabs.

Describe alternatives you've considered
We also considered adding permissions to Archivematica to allow deletion approval from there, which we would not rule out as a future iteration.

---

For Artefactual use:

Before you close this issue, you must check off the following:

• All pull requests related to this issue are properly linked
• All pull requests related to this issue have been merged
• A testing plan for this issue has been implemented and passed (testing plan information should be included in the issue body or comments)
• Documentation regarding this issue has been written and merged
• Details about this issue have been added to the release notes

[sallain]

This is looking good! These are the things that I tested:

• Admin, manager, and reviewer users can delete packages
• Reader users cannot delete packages
• Admins have all functionality, as in previous versions
• Managers have all functionality except the ability to create/edit users
• Reviewers cannot create new or edit pipelines/spaces/locations or create/edit users

I made a little permissions matrix that we may want to include in documentation in the future.

I have not tested:

• Performing any of the above via the API

As @sevein has noted, the release notes should include an advisory to users about how this permissions change affects existing users:

Existing authenticated users will receive all permissions with the exception of user management (e.g. they will become manager users)
Existing admin users should just stay as they are (superusers have access to all the things)

@sevein and @sromkey let me know if there is anything else I should look at!