Custom role: allow createNewCollections without access to all collections

[opirgali-tech]

On 1.37.3 a Manager can create collections only if they also have access to all collections. In the membership JSON the three collection permissions of the Custom role are tied to the same flag:

"createNewCollections": membership_type == 4 && self.access_all,
"editAnyCollection":    membership_type == 4 && self.access_all,
"deleteAnyCollection":  membership_type == 4 && self.access_all,

and post_organization_collections rejects a Manager without access_all. I see the TODO: Add full support for Custom User Roles right next to it.

This blocks delegation for us: to let a team lead create a collection when a new project appears, we would have to give them visibility of every collection in the organization, including other teams'. So every collection goes through an admin. Nested collections are affected too, since nesting is just a slash in the name.

Would you consider splitting createNewCollections off from editAnyCollection and deleteAnyCollection, so that a member can create collections while still seeing only the ones assigned to them? I realize this needs somewhere to store the permissions per member instead of the single access_all flag. Happy to do the work and open a PR if you are open to the direction.