Require new separate role for publishing records: trusted-publisher
- among others, this is a preparation for having users gain the rights for self-publishing records only after their first record has been approved by an admin
- publishing records now requires a user to be one of the record's owner and have the 'trusted-publisher' role assigned
- also add an option to automatically assign the required role to new users on registration (similar to the AUTO_TRUST_CONDITION, and only if that has been fulfilled for the user)