Introduce Vendor Root Account

[ashcherbakov]

User Stories:

• As Trustees, we can propose and approve a Vendor Root Account associated with a particular Vendor and vid, so that this Vendor Root account can create and manage (update, delete, rotate keys) sub-accounts associated with the same Vendor.
• As a Vendor Root account, I can create sub-accounts associated with my Vendor, so that multiple accounts for the same Vendor can be created without a need to involve Trustees into this process
• As a Vendor Root account, I can delete sub-accounts associated with my Vendor, so that an existing account can be immediately disabled in case the corresponding employee leaves.
• As a Vendor Root account, I can update sub-accounts associated with my Vendor, so that the sub-accounts can be managed without a need to involve Trustees into this process

[jcps07]

DCL-TT: New feature (#523) may reduce the need of this one. Further discussion required.