Create and implement PublisherSupervisor permission on rocketfuel API endpoints (bug 906862)

From bastadoc®:

> A supervisor can only modify the contents of the collections he or she is a supervisor of. A supervisor cannot modify the collection’s properties (associated carrier, region, etc.) and must ask an app publisher or admin to make these changes on their behalf.

I chose to implement this as a complementary permission to PermissionAuthorization that checks for either `Apps:Publisher` or `Apps:PublisherSupervisor`.

I'm unhappy with the naming of these classes, now that the name of the tool has changed. I'd suggest these name changes:

* `Apps:Publisher` => `Apps:CuratorAdmin`
* `Apps:PublisherSupervisor` => `Apps:Curator`

Thoughts?