Create a sub admin role for managing certain db connections

**Is your feature request related to a problem? Please describe.**
Currently, if you are a Metabase admin, you have access to all database connections and settings. There's no way to give someone access to only some database connections and/or let them add new ones. General users need to submit their requests for updated db connections through admins.

**Describe the solution you'd like**
Admins should be able to assign a sub-admin role, which gives a user the ability to edit certain db connections and, if the admin desires, the ability to add db connections. I think the sub-admin would need to be tied to groups, so that the new db connections would appear in the groups for which they are a sub-admin.

**Describe alternatives you've considered**
Currently, I think the only way to achieve similar functionality is to host multiple instances synced through serialization and assign your "sub-admins" to different instances. In this set up, your sub-admins still have access to all admin settings in their instance.

**How important is this feature to you?**
The feature could help reduce bottlenecks in internal use cases for large organizations and add new capabilities in embedded contexts. At large organizations, departments may desire to update or add their db connections without requesting support from their Metabase admin. In embedded use cases, groups of end users may desire to add their own data sources to enhance their reports.

The issue names no files, tests, or entry points. Start by tracing the existing admin roles, group permissions, and database-connection settings, then define how a sub-admin is scoped and whether adding connections is allowed. Done means the role can manage only its assigned connections and groups without broader admin access, with coverage for the permission boundaries.

Written by the indexing model from the issue text.