Clarify what is meant by 'write' in the documentation

[teabot]

We make a distinction between 'write' and 'create', but understandably this may cast doubt on what behaviours 'write' encompasses. We should call out in a list something like:

• Read: anything that does not mutate metadata.
• Write: anything that might create or mutate metadata with the exception of the creation of databases.
• Create: Creation of databases.

Alternatively we could create a matrix of all metadata actions by support in each access control type.

[massdosage]

@teabot any chance you'll get to look at this? (I'm just trying to tidy up issues that have been open for a long time)