Make allowed rolles to assign as UserManager more flexible

[daniellienert]

With #2322 we introduced the administration of users without Administrator rights. Which roles can be assigned by this role is however hard coded and duplicated in the Controller and the ViewHelper.

Centralize this logic and make it adjustable in customer projects.

[lorenzulrich]

This part of Neos is still quite messy and using the UserManager role together with sandstorm/NeosAcl won't work as I reported in sandstorm/NeosAcl#41.

Was the main argument against 43a9ea9 that it doesn't cover all use cases?