Allow having invitePerson without inviteBulk

Problem/Motivation

For UX reasons we want to provide "invite user", but not "invite bulk".

Steps to reproduce

Proposed resolution

- Add a separate permission for invite-bulk
- Add an update that sets the permission when applicable

Remaining tasks

User interface changes

API changes

Data model changes