analytics-api role

I'm assuming the `release` branch is the correct one to make a PR into.

Most of this is just backported from the HEAD of edx/configuration

@jrbl @stvstnfrd