Set up Jenkins role-based access

Summary:
The role-strategy plugin makes it much easier to administer who gets
what set of permissions. Rather than setting permissions per-user, as
with the matrix strategy, we set them per-role then assign users to the
roles.

The basic plan is this: Jenkins access is limited logged-in users on the
@khanacademy.org domain. Of these, some folks get full admin access to
Jenkins to inspect the workspace and disable, enable, and configure
jobs, and everyone else can view job started and start or cancel builds.

The workspace security part is important because sensitive files may be
generated by deployments.

Test Plan:
This simply copies the config from jenkins.khanacademy.org:

  $ ./fetch_jenkins_config.sh

Reviewers: csilvers, desmond

Reviewed By: desmond

Differential Revision: http://phabricator.khanacademy.org/D2731