Add specific ACL for QA related activities

[mattiaverga]

The "waive tests" and the "re-trigger tests" services are currently using the same ACLs used for allow editing an update.
I suppose we can add a new ACL to give members of qa group access to those functions, without the need to have them allowed for full editing.

[mattiaverga]

I haven't got any time to look at this, but I think there are two places that need adjustments.
First, we need a new setting to define CI allowed groups.
Then, into validators.py I think we need a new validate_ci_acls method which either returns nothing if the user is in CI allowed group or fall backs to standard validate_acls.
But I think we also have to deal with Pyramid ACLs in security.py, but I need to figure out how they work exactly with Cornice...