There seems to be no way to give someone permission to create configurations in a tree without giving them overall system administrator permissions. I should be able to create a group, and be able to grant a "Create Configuration" permission on a particular tree, just like any other permission.