As a user with right "centralnotice-admin", I am the only role that can set state Published for CN message groups, so that I can protect what is published through CN (step 7).

Acceptance criteria:

1. changes into certain state can only be done by users who have right X.

Version: master
Severity: enhancement