store masked permissions on user model

[unenglishable]

get_masked_permissions is called in format_user_reply as well as in helpers/acl
(any time permissions need to be calculated)

this is expensive and unnecessary if we consolidate by storing the calculated value on the user model itself in the database
this will lower the time complexity to read and remove any duplicate calls

create: store on model in db
update: when user/role is updated