Add "limited builder" role

Description of the feature request

I need to define a group that has the “developer” role, but is restricted to which workflows they can manually start. I think this would also require updating each workflow to have a field about which groups(s) can trigger that workflow.

Use case / for what or how I would use it

We have lots of workflows that are mostly harmless that we want any “developer” to be able to start manually. However we need to restrict our “release” workflow to only a few “developers”.