Add revokePermission config action

Closes #3500184

I did not find a test coverage for grantPermission in 74da82a3 or later, so I wonder whether it is a requirement in this case or not.

We generally don't want recipes to be destructive/remove things, though there are a few examples of this. Adding a test/tests showing a use case would be helpful here I think.

I'm not sure I'm entirely convinced by the use case described in the issue summary, to be honest. I looked at the recipe linked in there and, as far as I can tell, the extent of the use case is to remove the view usernames permission from the basic roles.

But that leads to more questions. Where does the view usernames permission come from? It doesn't seem to be defined by the core User module -- is it a core permission? What is assigning it to the basic roles?

It comes from the installed module by the Recipe (View Usernames) and the Recipe just tries to enforce that if the module was installed already then its configuration matches with the original intent of the recipe. Pleasr let me know if this is not right use case of a recipe.