Update the broadcast roles

We've added new broadcast roles in the database (`create_broadcasts` and
`approve_broadcasts`).

Adding these has meant we've needed to do a bit of a rewrite of the roles and
permissions code since this had been based on the assumption that each
database permission only belongs to one admin role - this is no longer true.
This means that flipping the roles dict round to create a dict which
contains database permissions as the keys is no longer possible. We can't
necessarily tell which admin role someone has given a database permission.

To check if a user has an admin role given a list of database permissions,
the user must now have ALL the database permissions mapped to that role
(instead of just one). This works because no one has the `manage_users`
permission without also having the `manage_settings` (and similar for
the other admin roles which map to multiple database permissions).

Some test data was changed because it was using admin roles where
database permissions are actually used when the app is running. I've kept
the functionality of the `translate_permissions_from_db_to_admin_roles`
function passing through any unknown roles it is passed as an argument.
This is not necessary, so can be changed later if we decide it will not
ever be used. However, removing it would require updating a lot of
tests since the tests rely on this behaviour.

tests/app/main/test_permissions.py

@@ -18,10 +18,34 @@ from tests.conftest import (
 )
 
 
-def test_translate_permissions_from_db_to_admin_roles():
-    db_perms = ['send_texts', 'send_emails', 'send_letters', 'manage_templates', 'some_unknown_permission']
-    roles = translate_permissions_from_db_to_admin_roles(db_perms)
-    assert roles == {'send_messages', 'manage_templates', 'some_unknown_permission'}
+@pytest.mark.parametrize('db_roles,admin_roles', [
+    (
+        ['approve_broadcasts', 'reject_broadcasts', 'cancel_broadcasts'],
+        {'approve_broadcasts'},
+    ),
+    (
+        ['manage_templates', 'create_broadcasts', 'reject_broadcasts', 'cancel_broadcasts'],
+        {'create_broadcasts', 'manage_templates'},
+    ),
+    (
+        ['manage_templates'],
+        {'manage_templates'},
+    ),
+    (
+        ['create_broadcasts'],
+        set(),
+    ),
+    (
+        ['send_texts', 'send_emails', 'send_letters', 'manage_templates', 'some_unknown_permission'],
+        {'send_messages', 'manage_templates', 'some_unknown_permission'},
+    ),
+])
+def test_translate_permissions_from_db_to_admin_roles(
+    db_roles,
+    admin_roles,
+):
+    roles = translate_permissions_from_db_to_admin_roles(db_roles)
+    assert roles == admin_roles
 
 
 def test_translate_permissions_from_admin_roles_to_db():
@@ -66,7 +90,7 @@ def test_services_pages_that_org_users_are_allowed_to_see(
     api_user_active['services'] = user_services
     api_user_active['organisations'] = user_organisations
     api_user_active['permissions'] = {
-        service_id: ['manage_service']
+        service_id: ['manage_users', 'manage_settings']
         for service_id in user_services
     }
     service = service_json(