Right now, we have a fullAccess flag for each ResourceRole which means a resource can either have or not full access (read/write) on a challenge.
We should split this into two flags (fullReadAccess and fullWriteAccess) so we can chose which roles have what sort of access.
For example, a manager/copilot can have both and an observer can have only fullReadAccess etc
cc @rootelement