Allow limited-collaborator role users to promote/demote images

[askfongjojo]

The new limited-collaborator role is only prohibited from making VPC-related changes. They should be able to promote project images to silo level and vice versa, like users with the collaborator role. Currently, they get a permission error when trying to do so.