Add system roles for default resource context. Enforce access controls
on default resource context. Add behave tests that prove enforcement
works. Add migration so that users don't lose the access they already
have.
Fix check for private and null context on post of a private program.
Merge branch 'develop' into feature/system-roles
Merge branch 'feature/mapping-cleanup' into feature/system-roles
Now with authorizations widget in admin dashboard.
Fix role assignment migration so that current users are object editors
and program creators and don't lose rights.
Import warning changes and people import metadata validation
Changes to metadata check for people import
Fix migration to execute the lookup for ProgramCreator role.
The created_at and modified_at fields must be set in the migration.
Fixing db update typos
Exposing Role.scope to the frontend
Enable pre-caching mustache templates from extensions

* Previously, including them would change the path/name used in
  GGRC.Templates; now it checks for 'assets/mustache' in the path and
  removes it.
Add mustaches in ggrc_basic_permissions to GGRC.Templates
Added scope filtering to authorizations widget

Will always use the scope for the current page to filter the available
roles
Added role scope editing
Changed system roles so that they can't be created or have their scope changed
Fix import indexing issues

* In some cases, objects can exist in both `session.new` and
  `session.dirty`, so ensure we don't try to create duplicate index
  records.
Fixing issues with client-side permission enforcement (as well as permissions serialization)
Added item-specific read access blocking and "no access" messages