Issue 9354: Make permissions for deleting changes more flexible

Can we make the permissions for deleting changes a bit more flexible?

Currently changes can only be deleted by administrators, or by the change owner if they have the "delete own changes" permission.

This means that for example in a system where projects are separated by namespaces and we assign permissions to "owner" groups based on those namespaces, we can't allow such an "owner" to delete changes.

This would be more flexible if we also had a "Delete Changes" permission that could be assigned.

Note that here we're only talking about open changes; permission to delete merged changes should probably remain possible only for admins.