Increase granularity of permissions for workflow actions

It seems that the copy, move, unpublish, and publish operations are all tied to the domain: "hippo:documents". Giving someone author role to that domain removes all those operations and only allows them to do publication/depublication requests. We have requirements to allow an author to copy a document (and move an unpublished one) but not to publish.

It currently is not possible to limit access to these workflow actions separately or limit access to the workflow menu items. This has been requested by a number of customers and would be a generally useful improvement.