Add permissions and workflow to change advisory

[rainer-exxcellent]

The Roles have the following permissions:

• Author: may list, view and edit and delete own (by the user) CSAF documents in Draft status
• Editor: inherits the rights of the "Author" role,
  • may list, view, edit and delete all Advisories in Draft status
• Publisher: inherits the rights of the "Editor" role
• Manager: inherits the rights of the "Publisher" role