Add a more fine-grained ACL system

[chrean]

Many of the users we interviewed mentioned the lack of a more fine-grained ACL system as a pain point with Solidus.
We could review an unmaintained extension ( https://github.com/boomerdigital/solidus_user_roles ) and integrate it into the core. It should be a relatively low-effort, high-impact activity.

[BenMorganIO]

We already have a lot of can? checks throughout the system. Perhaps increased documentation may also be another low-effort, high-impact alternative. Both these solutions can go hand-in-hand.

[chrean]

You are right; however, even with its flexibility, we repeatedly heard from users that they would love a more straightforward way to manage permissions because devs are not the only users/stakeholders and cannot be a bottleneck.
I hope it makes sense.

[chrean]

Closing because we will create an epic for this, with more specific subtasks.