Permissions per request type

This feature uses permissions defined in Signonotron to hide/prevent certain request forms from being available to users who don't have the appropriate rights.

The exact spec for this story can be found [in the permissions.feature Cucumber file](https://github.com/alphagov/support/blob/2552818a88112b074281564bfe2c19ffebc3e185/features/permissions.feature).
This PR includes:
* [x] a refactoring to extract a common Request class (8f5a2d9) - not strictly related to this PR
* [x] introducing roles and permissions

This PR is best reviewed commit-by-commit.