Show the blocks list on review UIs and the diff viewer.

The new 'blocks' variable wasn't provided on review UI pages or on the
diff viewer. Now, make_review_request_context will provide it if the
caller does not.
Add support for permissions specific to Local Sites.

Local Sites had no equivalent of our custom permissions, like
can_change_status or can_submit_as_another_user. It also didn't grant
these abilities to administrators of Local Sites.

Now, a LocalSiteProfile defines a permissions dictionary, which contains
all granted permissions for the user. Local Site administrators
automatically have all permissions for a Local Site.

To do this, we make use of an AuthBackend's ability to do custom
permission lookups. The main function for this, has_perm, can take a
parameter for the object permissions are being looked up on.

This parameter is unused by default and in fact not allowed on any
built-in backends. Django doesn't make any real use of it. The intent
appears to be to pass an object like a ReviewRequest to it, but there's
no real rules governing this.

For our usage, passing a LocalSite as the object will have it look up
that permission in the user's list of permissions for the LocalSite. All
callers must then do when checking permissions is to pass the LocalSite
(or None) when calling has_perm.

The 'perms' context variable for templates has also been replaced with a
version that will pass the LocalSite for these requests.
Fix a series of breakages noticed while browsing as anonymous.

While accidentally logged out, I noticed a few breakages with review
requests.

First off, everything was editable, and many things were not responding
or loading correctly. This was due to a misplaced </div>, which caused
elements to not appear where they were expected, breaking a bunch of
lookups. That has been fixed.

One glaring problem was that the expand/collapse buttons were flat-out
missing. This is actually noticed while loading any review request at
first, until the JavaScript loads. This was easily fixed by giving them
default icons matching their initial state.

I was also able to edit (or attempt to edit) review requests. Our
'editable' state only considered whether the review request was opened
or closed, not whether the user had access. It now considers whether the
requesting user has edit permissions or owns it.
Merge branch 'release-1.7.x'