Issue #3204083 by kristiaanvandeneynde: Rework group roles into a scoped system and adjust permission calculation