Add teams that represent a set of users

This feature has actually already been discussed in #2772 (closed), but as teams and nested groups are not depending on each other, it seems more natural to discuss them in separate issues.

For me, a team is simply a set of users. These teams can then be given access rights to groups or projects just like single users.

If a user has been granted access to a group or project in multiple ways (one or more teams and possibly also as single user), the highest access level should be used.