For this change, the ACL yaml from the admin interface has to be copied
and added to the configuration yaml of the iapi.

also, add a new invite permission to the acl.

'public' allows one to create non-admin invitations for all public domain.

'all' allows one to create:
* invitations for all public domain
* user invitations scoped to custom domain
* admin invitations scoped to custom domain

Permissions are communicated to the frontend in this format.
This PR should be still compatible with the existing invite generation in
the admin IF. I will add this in a later step.

This needs the following addition to the acl config:

    invite:
      public:
      - power-user@example.com
      all:
      - admin@example.com