Correct privileges on outbox and inbox

[evert]

Currently both the out- and inbox are using a few privileges that are outdated, and are missing a few current ones.

We should add the correct privileges from RFC6638 and get rid of support for the earlier drafts. Also a good idea to make the scheduling plugin actually use these privileges.

While this change won't land in time for a 3.0 release, we can relatively easily add this in a later point release (3.0.1) as this will have minimum impact.