API: access tokens require admin permission for post/delete

[steadfasterX]

semaphore version 2.8.92

This is not a bug report but more a feature request.

Reproduce steps:

1. Add a local user account and link it to a project.
2. Grant this user the owner role
3. Create an api token as described in the docs
4. Try to create a template

Result: 403 not authorized

I have tested only template creation as of now but i assume this is for any api post / delete call.

Workaround: make this account an admin account

I guess this is expexted atm bc RBAC is not fully implemented yet but a hint in the docs would be fine and I want to ensure to keep track of tokens in rbac :)