Allow name write privileges to be withheld

[Firstyear]

Fixes #2772 - Allow self write name privileges to be withheld. This is achieved by moving the legal name and display name write to the self name write acp, and adding a group that enables or removes this access. This allows admins to remove idm_all_persons from this group to disable the ability for users to self modify their name related values.

I don't really like this feature but I see it's importance for schools and some businesses. I don't want it to be the default, but I also recognise that it's needed in some environments.

Checklist

• [ x ] This pr contains no AI generated code
• [ x ] cargo fmt has been run
• cargo clippy has been run
• [ x ] cargo test has been run and passes
• [ x ] book chapter included (if relevant)
• design document included (if relevant)