Look at the `group_ability` and
`project_ability` fields to understand
the scope of the permission.

There's some light reorganization of the table here as well.

The `enabled_link` and `feature_flag`
logic is no used, but let's keep it for
now.