Don't require edit permission to assign role

At the moment, it's only possible to assign a role to a user if you have permission to edit that user.

However it's easy to imagine scenarios where we might want a sub-admin who can assign roles but not edit users. For example a moderator might have access to grant roles like "trusted", "expert" to users who have consistently made intelligent comments in a forum. In this case the sub-admin can use actions to assign roles.

Allow access if:
1a) The sub-admin can edit the user OR
1b) The sub-admin can assign all the roles the user already has AND
2) The sub-admin can assign all the roles that are being changed

A second benefit of this change is that it reduces the likelihood of cases where the sub-admin assigns a role to a user then no longer has permission to remove that same role.