Permission makeover

Permissions are hard to configure right now, maybe they can be simplified?

Maybe the role should just have types of petitions allowed on all endpoints and the configuration instead of a whitelist (as it currently works) should be a blacklist.

Start by reviewing the current permission, role, and whitelist configuration used by the REST API. Define the desired role-level petition permissions and blacklist behavior, then verify that the configuration consistently enforces those rules across all endpoints.

Written by the indexing model from the issue text.