Require new separate role for publishing records: trusted-publisher

• among others, this is a preparation for having users gain the rights for self-publishing records only after their first record has been approved by an admin
• publishing records now requires a user to be one of the record's owner and have the 'trusted-publisher' role assigned
• also add an option to automatically assign the required role to new users on registration (similar to the AUTO_TRUST_CONDITION, and only if that has been fulfilled for the user)