Fixes #1149 where "other" user's subscription for non-deleted, direct message, was not deleted.  This led to duplicate key error if a new user, with the same username as the deleted user, is created and tries to direct message the "other" user.

Adds 2 new permissions related to bulk user registration and bulk channel creation.  Permissions are assigned
admin role.

The nimble:restivus package, used by REST api, does not support alanning:roles with 'groups'.  It doesn't even
use the alanning:roles API to check for roles.  As a workaround, I removed restivus's rolesRequired check from
the bulk api methods and added Rocketchat.authz.hasPermission checks.

Update rest bulk api to work with backend changes and remove role requirements because restivus is not compatible with alanning:roles with groups

Update message pinning to show up on the tab list with a few options to allow/disallow it and whether to allow anyone to pin messages

This change also alters how edits are displayed both for sequential
and non-sequential messages.

See #1357

This uses a special "?" character that is understood by the /avatar/
route and will be treated specially. This change also adds url
encoding/decoding around username usage via the url for the avatar.

This comes in the form of the user's avatar, along with a hover
title that shows username and edit time. As a side note, this
requires us to start saving 'editBy' id as part of message updates.

This has been tested with all 4 of the current avatar methods.

fixes #824