Allow remote "subadmin" access

This adds several new config variables:
    OPTION_ADMIN_REMOTE_SUBADMIN - whether to enable this
    OPTION_ADMIN_LOCKED_FIELDS_SUBADMIN - locked down subadmin access fields

These all use the CGI variable REDIRECT_REMOTE_USER, as per proxied access,
this should perhaps be made more general if will be deployed outside of
mySociety servers.

We also have a utility method for accessing a user object for these users,
get_admin_user.
Moderation details on moderating comment