Define roles for IPM

We need to give IPM to be able to manage roles granting relevant SQL permissions for IPM actions (which are particularly messy otherwise). There should be a separate API to grant all relevant SQL permissions to a given existing user/role.

This needs more investigation/specification, but my gut feeling is that there should be two roles:
%IPM_Read to grant relevant SQL privileges for read operations via IPM
(possibly) %IPM_Write to grant relevant SQL privileges for any inserts/updates (not sure of the extent to which we use these - most of IPM operates through objects)

We'll want zpm "enable" to manage these roles across different namespaces, provided the roles exist. We may also want to define resources with the same / related names.