allow users to edit client ACLs for their own clients and create users for their clients

We should add a permission for users to create new users for a client. This goes in pair with an 'edit own clients' permission that would allow users to control the ACL for their clients (as opposed to administer clients, which lets you control any client). This follows from #371769: allow for n to n and typed user/client relationships.