Grant/revoke access to an investigation #222

There rules are needed:

CD,,SELECT iu FROM InvestigationUser iu JOIN iu.investigation i JOIN i.investigationUsers iu2 JOIN iu2.user u WHERE u.name = :user and (iu2.role = 'Principal investigator' or iu2.role = 'Local contact')and u.name = :user
CRUD,admin, InvestigationUser  

This issue changes the API but it is compatible backwards. Two new endpoints have been added in order to add and remove investigation Users.

Related to E-DataPortal#480 (closed)