Allow roles to avoid update

This patch creates permission bypass auto_username. Anyone with this permission does not have their username changed.

An issue with this is that it means the administrator user is unavoidably exempted. Potential solutions:

• A config variable that skips the permission check for admins.
• Instead of a permission, have a config variable that stores which roles should be exempted.

Another way of managing this would be to create a hook which gets invoked in auto_username_user_insert(). Modules could implement this hook to change what the username gets updated to or to cancel having it get updated. This would give lots of flexibility to developers.