Since !3480 (merged) was controversial, this is the uncontroversial part.
It adds a new plug, UserIsStaffPlug which is very similar to UserIsAdminPlug, except that moderators and admins can both pass through it.
For now, all AdminAPI endpoints still require the user to be an admin. This is just a first step to adding support for moderators.
No changelog entry because this is not user-facing.