feat: add 'own' permissions and test coverage

This adds the new permissions and removes the old ones. It provides a hook update to migrate the roles to the new permissions.

There is also a kernel test with coverage of the permissions and associated access control.

Closes #3528161