Creating a new channel should only be allowed for users granted role 'channel-admin' for the hst site

org.hippoecm.hst.platform.services.ChannelServiceImpl#persist should fail for cms users that have readwrite on /hst:myproject.

It should only succeed for channel admins:
the user needs to have privilege 'hippo:channel-admin' on the target hst site configuration, which by default is provided by the role 'channel-admin' of the authrole /hst:domains/hstconfig/channel-admin.

Also we should investigate when the 'create new channel' is visible in the Channel Manager overview