Update module should implement hook_permission for security update notifications

(Same issue here: http://drupal.org/node/1177752. I'm re-posting this for 8.x-dev.)

When a security update comes out for Drupal, Update module displays a red notification on admin pages saying, "There is a security update available for your version of Drupal". If you're a site administrator, this message is helpful. But if you're not the person responsible for keeping the site up to date, this message can be scary. As a result, many site-builders turn off Update before handing a website over to end-users to prevent end-users (content managers, etc.) from getting upset or worried when it's time to update the site.

Since Update doesn't implement hook_permission at all, security update notifications are "all or nothing". If Update module is enabled, everyone who has access to admin pages see the warning. If you don't like this behavior, the only option is to turn Update off.

Wouldn't it be better to have Update module provide a permission for seeing (or not seeing) these security update notifications? This seems like a better solution for two reasons:

1. It just seems like a more elegant solution to have access to the warning message be permission-based / role-based.

2. For modules that depend on Update module, the current state of things is no good. Custom modules can't take advantage of Drupal core's Update module without forcing site builders to choose between added functionality and user friendliness.