Implement group permission for viewing form action needed

[signebedi]

Service accounts need to be able to see actions needed on a form submission. It would be straightforward to implement this feature as an admin route, but generally service accounts will not be given admin permissions, cf. #329. This can be implemented by adding a new form permission called something like read_actions_needed. However, it may actually be that this is not the most effective way to implement this feature, given the likely business process that organizations will follow when aggregating action-needed data. Instead, we might want to consider expanding group permissions from just encapsulating forms, to also encapsulating users. For example: form:example_form:read_all could be one permission scope, whereas group:group_name:read_actions_needed could be an additional permission. Obviously, a group will be able to see its own actions needed... so this risks being a little clunky if we don't approach it carefully.

Originally posted by @signebedi in #62 (comment)