action-based permissions

Quite a few of the new permissions describe a specific action, e.g. change due date (UIU-582) or cancel a request (UIREQ-110).

The backend APIs currently have permissions to allow a user to either edit (replace) a record or not.

In order for specific actions to be associated with specific permissions we need to decide upon a general approach to how we model (name of permission, how is it described in the API and how we describe what action it relates to).

3-17-2021: Since this jira has been created, the practice in the community has been more hands off with these kinds of technical decisions, with the idea being that a team with capacity can explore a requirement and propose a technical solution that could meet their needs and then be considered by other teams as requirements in their areas. This seems to be what is happening with permissions in this area, and there are explorations happening with things like permission overrides that are related to this need. Accordingly, the features that were blocked by this jira have been unblocked to make it easier to see that development on those features can and should proceed based on team and subject area priorities and capacity - enettifee