Per consensus on Commons, define a new protection level called 'templateeditor'.
A new user group called 'templateeditor' should be created with the following rights:
- Edit protected templates (templateeditor)
- Enable two-factor authentication (oathauth-enable)
- Override the title or username blacklist (tboverride)
The right 'templateeditor' should also be given to the user group 'sysop'.