nfctokens: additional settings to control which users can configure tokens

[timhawes]

Option to allow token enrolment for "any user".

Option to allow token enrolment for "any user that has been assigned to any group" (this would imply that the user has been recognised by an admin or group owner).