Impersonating Troubleshooters can now impersonate users and groups

[labkey-adam]

Rationale

https://github.com/LabKey/internal-issues/issues/837

Changes

• The only functional change to note is that Impersonating Troubleshooters can impersonate users and groups in the root. If they happen to have read permissions in a project or folder, they can impersonate users, groups, and roles there as well.
• Internally, I've reworked impersonation permissions checking to eliminate duplicate checks. A new ImpersonatePermission class is now used instead of AdminPermission as the primary check. Action-level and manager permission checking has been removed; all permission checking is performed by a single method in each impersonation context for simplicity and consistency.