[META] Centralize all permission calculations/operations

Code's finished, turning this into a meta issue and adding smaller patches in child issues.

Everything went green! So now all we need is a change record for this meta issue.

A potential follow-up that is now possible is the altering of permissions by firing a "calculating group permissions" event from GroupPermissionCalculator.

Attached is a final patch that cleans up the previous work.

Most notably, it moves away from using "magic arrays" to represents permissions per scope and actually introduces a CalculatedGroupPermissionsItem value object which represents an account's permissions within a given scope. This allowed for further simplifications in the permission checker, calculator, hash generator and context.

Will need a change record for the new API and for the hash generator refactoring (because BC, sadly).

Will write up change records after lunch and then this can be considered Fixed.