Maybe add to bulkupdate "if permission is temporary" for example to remove all users from vip group if they are only temporary in it

Will be included as part of larger changes to the bulk update system, to be implemented after #1739