Permissions for REST API and Companion App

[Andreas]

Actual behaviour

The Companion App will get features for navigating the main game (#381), editing users (#176), and queuing songs (#247).
In a first version, this will be implemented without permissions.

Expected behaviour

Permissions for these features should be granted explicitly. This serves multiple purposes:

• the initial UI of the Companion App is simple when only minimal permissions are set
  • new users do not get overwhelmed
• not everyone in the room can mess with songs, controls, and config