Require two releng signoffs for changes to permissions

[gabrielbusta]

#2194

[gabrielbusta]

I tried to implement two admin sign-offs. Because that moves us from looking at "roles" when checking sign-offs to looking at "permissions" it required refactoring in the back-end and UI. I ended up hard-coding 2 "releng" sign-offs. Before this lands in production we need to make sure that nobody currently has that role that shouldn't.

[jcristau]

I'm a bit unhappy about hardcoding a specific role here (iirc we don't do that anywhere else). More importantly, this will break local setups where there may not be 2 users with that role.

Finally, before we merge anything we'll need to add tests.