User Manager only shown if user has super_permission policy

[nmcharlton]

The User Manager tool should be available to all admin panel users who have a role with the manage_user or list_user policy.
Currently, only the super_permission policy is checked when deciding whether to show the tool.

There's a corresponding shortfall in the API whereby only the super_permission policy allows access to /auth routes to modify user details - this will need to be addressed first or at the same time to ensure compatibility.

[tranquanghuy0801]

@nmcharlton Can I work on this issue?